Data Protection Privacy Notice
Last Updated: 25 November 2021
The LMA is committed to protecting and respecting your privacy. This notice describes how the LMA collects and uses personal data and the rights you have in relation to your personal data.
This notice was last updated on the above date and may be amended from time to time, so please do check for any amendments. Any significant changes to this notice will be clearly indicated on the homepage of the website.
The Loan Market Association ("LMA") is registered at 8th Floor, 20 Farringdon Street, London EC4A 4AB. The LMA acts as a data controller with respect to the personal data provided to us. The LMA is registered with the UK Information Commissioner's Office ("ICO") under the following ICO registration number: Z5349255.
If you have any questions in respect of this notice, or would like to exercise your rights as stated in this notice, please contact us at: firstname.lastname@example.org; or at our postal address: LMA, 10 Upper Bank Street, London E14 5JJ.
What personal data we collect
Our customers: We collect personal information about individuals who choose to register for our website and services. The personal data we collect consists of an individual's name, work email address, work telephone number, country of residence and job title. We also collect similar personal data on individuals who register to attend LMA events, speak at LMA events or take part in LMA projects as well as personal data consisting of passwords, social media account URLs and profile pictures.
In addition we may collect profile photos and biographies for delegate booklets. We also collect personal information about the contact within organisations whose details are listed in respect of bookings for LMA events. We may also collect personal information of the accounts teams within organisations whose details are used by the LMA in respect of the management of their accounts.
If you attend a virtual event or physical event at which we provide the option to interact with sponsors, exhibitors or other delegates via an app or online platform, we (or our service provider on our behalf) will collect details of who you have interacted with and any content you download or view.
Our suppliers: If you work for an organisation that provides goods or services to us, we may collect your contact details (including name, job title, email address, phone number and physical address) to enable us to manage our relationship with you and the organisation you represent.
How we collect personal data
Our customers: The LMA collects the personal data detailed above in relation to individuals who: (i) register for an individual LMA user account; (ii) subscribe to receive email alerts from the LMA; (iii) register for LMA events; (iv) request or purchase LMA services (e.g. provision of documents to non-member individuals); (v) are referred to us by either our members or non-members (e.g. to speak at, or attend, an LMA event); or (vi) voluntarily provide information to us for other purposes (e.g. by providing business cards to LMA staff or filling in feedback forms for LMA events). Such data may be provided to us by you filling in the appropriate forms on our website or at our events. You may also provide us with personal information if you contact us by email, telephone, post or otherwise.
Our suppliers: The LMA collects the personal data detailed above directly from you or your colleagues at the time we start purchasing goods or services from you or your organisation, or from details published by your organisation in relation to its goods or services prior to us contacting your organisation to request the provision of such goods or services. We also store the contents of communications that you send to us.
How we use personal data
The LMA uses the personal data it holds to: (i) provide membership benefits and services to you; (ii) communicate with you about our services (e.g. alerts on new documents and events); (iii) to process and respond to requests, enquiries or complaints received from you; (iv) to deal with account enquiries you may have; and (v) fulfil our legal obligations.
The LMA only uses personal data for legitimate business purposes and in accordance with data protection legislation. In particular, we use the data we collect to deliver services (for example, we need to use your personal information in order to register you for an LMA event). We may not be able to provide you with some of the features and functionality provided by LMA membership (for example, access to documentation) without access to your personal data.
The LMA has a number of legal bases for processing personal data, primarily being the legitimate business interests of the LMA in the provision of membership services. We also process data for which you have given your consent (which you may withdraw at any time through your online account settings or by contacting us at email@example.com) and where the use and processing of data is necessary to perform a contract with you.
We only request information necessary for these purposes and use this in a proportionate manner. For example, we will only contact you with updates that you have elected to receive on registration (or as subsequently updated).
How to manage your email alerts
We may ask whether you wish to receive email alerts from us and this will be presented to you as an option on the appropriate application form. We will not send you email alerts if you ask us not to.
If you have agreed to receive email alerts but you later change your mind and no longer wish to receive these emails, you can change your preferences at any time by amending your 'Personal Profile' on the website. Please note that you may also unsubscribe from LMA email alerts by clicking the 'unsubscribe' link at the bottom of any email alert sent to you by the LMA. You can also contact us directly at firstname.lastname@example.org and request to be removed from our distribution lists.
Disclosure of personal data
Your personal data may be disclosed to certain third party service providers (the " Service Providers") in order to allow us to deliver our membership services to you and to manage and maintain our IT systems and keep them secure. These Service Providers currently include:
- Eudonet UK (who provide our membership database)
- Adestra (who provide our membership and subscription marketing email software)
- Rackspace (who provide our servers for the website and membership database)
- WorkCast (our webinar and virtual event provider; note that individuals provide this data directly to WorkCast when registering for LMA webinars and virtual events)
- Kineo (our e-learning provider; note that individuals provide this data directly to Kineo when registering for the e-learning course)
- Clifford Chance (who provide office and IT facilities to the LMA)
- Cvent (who are our events management and services provider and who provide on-site check-in and attendance management services)
- ServonDesign (our web design agency; information may be shared for the purpose of providing technical assistance to us – including but not limited to resolving technical issues with access to the LMA's website or other technical platforms that we may use from time to time, the set-up of the virtual events platforms and our use of social media platforms as a marketing tool)
- Kroll (who provide cyber security services)
- YUDU (who provide ebook publishing services)
- Miscellaneous venue providers (on whose property we may host events, for example hotels)
Please note that the above list is not exhaustive and we do our best to update this policy from time to time to capture additional Service Providers and/or change in scope of the services that they provide.
Your personal data may also be disclosed to LMA.Automate Limited, a company incorporated in England & Wales, (registered no. 12977361), whose registered office is at 8th Floor 20 Farringdon Street, London, United Kingdom, EC4A 4AB, a wholly owned subsidiary of the LMA, in order to allow it to deliver document automation services to our members. Please click here to see a copy of the LMA.Automate privacy notice for more information about how they process your personal data.
In addition to the above named service providers, we may from time to time share your personal data with professional advisers, including our auditors (details for which can be found in our accounts) and external legal advisers if and when necessary to enable us to take advice on our rights and obligations and operate our business in compliance with the law. These third parties are subject to professional duties of confidentiality. They also operate their own privacy notices, which are available from their respective websites.
Please note that personal data of individuals working at a particular LMA member organisation may also be disclosed to that organisation's nominated representative and any of its senior individuals represented on an LMA working party. This is to enable such nominated representative or appropriate senior individual to ascertain who in their organisation is an individual LMA member, which of them is on an LMA working party and which LMA events they have attended. Save as otherwise described in this policy, we do not share such data beyond an individual's organisation.
Sponsors, exhibitors. speakers and other delegates at events
In respect of LMA events, we may disclose delegate lists (which contain job titles and institutions) to speakers, sponsors and/or exhibitors at that event in order to allow the speakers to ensure their sessions are appropriately tailored and to enable sponsors / exhibitors to know who is attending the event. In addition, if you register for one of our virtual conferences or events, your name, work email address, job title, organisation, social media URL and profile picture (to the extent provided by you at registration) may be made displayed to other delegates in order to allow other delegates to contact you. You may opt to remove your name from this delegate networking list at any time by changing the settings in your personal profile on the Workcast platform or by contacting email@example.com.
Contact details of delegates are not shared with speakers, sponsors or exhibitors, save that, in relation virtual events only, the details outlined in the following paragraph may be shared with sponsors or exhibitors (as applicable).
If you enrol for one of our virtual conferences or events, and you interact with our sponsors or exhibitors at those events, then we may pass the following information to those sponsors: your name, job title, organisation, email address, phone number (if applicable), and reports of how you have interacted with the sponsor at the online event. Such interactions may include watching sponsor demonstrations, clicking on links, downloading documents, time spent viewing a virtual stand, and whether you engaged in any online chat activity or other virtual interactions with the sponsor/exhibitors.
Our sponsors/exhibitors are independent data controllers in their own right and you should refer to their privacy policies for further information on how they will process your personal data. If you do not want reports summarising how you have interacted with our sponsors/exhibitors to be passed to those sponsors/exhibitors by us, then please contact us at firstname.lastname@example.org as soon as possible, and by no later than the day after the date of the virtual conference or event itself.Storage and processing of personal data
The information that we collect is stored and processed in the United Kingdom (" UK") and the European Economic Area (" EEA"). The arrangements with our Service Providers may involve transferring information outside of the UK and the EEA. However, in these situations the LMA will ensure that transferred information continues to be protected by appropriate safeguards.
Security of personal data
The LMA has reasonable administrative, technical and physical measures in place to protect your personal data. We also require our Service Providers to have adequate security measures in place for the safeguarding of personal data processed by them and ensure our contracts with them require the Service Provider (and any sub-processors) to abide by their requirements under data protection legislation.
Your rights in respect of your data
Your principal rights under data protection legislation in respect of the personal data that we hold about you are:
- the right to access that personal data;
- the right to rectification of that personal data;
- the right to erasure of your personal data;
- the right to restrict and/or object to the processing of your personal data;
- the right to portability (i.e. transfer) of your personal data; and
- the right to withdraw consent to processing of your personal data.
We provide you with tools to access and control your personal data (namely the 'Personal Profile' section of the website). Alternatively, you can contact the LMA at any time (at email@example.com) to access or amend your data.
Please note that if you have any concerns about the handling of your personal data, you have the right to complain to a supervisory authority (namely the UK ICO).
Updating your personal data
We want to make sure that the personal data we hold about you is accurate and up to date. You may ask us to correct or remove any information that you think is no longer up to date. You can update, correct, or delete your personal data at any time by accessing your 'Personal Profile' on the website or by contacting the LMA at firstname.lastname@example.org.
Third party links and domains
The LMA website may include links to third-party domains (or applications). Please note that if you click these links you may be allowing third parties to collect your personal data. The LMA has no control over these third party domains, and cannot be responsible for their individual privacy statements. You should ensure that you read the privacy notice of every domain you visit.
We retain personal data for as long as your LMA account is active and otherwise as long as needed to fulfil the purposes for which it was collected (for example to operate your account), unless we have a legitimate interest in retaining the data for longer periods or are otherwise required to by law. We also keep personal data for as long as necessary for our legitimate business interests, to comply with our legal obligations, resolve disputes and enforce our agreements and legal rights.