Data Protection Privacy Notice

Last Updated: 11 May 2026

This notice describes how the LMA collects and uses personal data and the rights you have in relation to your personal data.
This notice was last updated on the above date.

Contact details

The Loan Market Association ("LMA") is registered at 13th Floor One Angel Court, London, United Kingdom, EC2R 7HJ with company number 03284544. The LMA acts as a data controller with respect to the personal data provided to us.

The LMA is registered with the UK Information Commissioner's Office ("ICO") under the following ICO registration number: Z5349255.

If you have any questions in respect of this notice, or would like to exercise your data protection rights, please contact us at: lma@lma.eu.com or at LMA, 10 Upper Bank Street, London E14 5JJ.

How we use your personal data
The below tables explain how we use your personal data depending on your relationship to us. Multiple sections may apply to you.

Members and customers

Scenario

Categories of personal data

Lawful basis

We send you newsletters or other marketing communications that you have subscribed to or which we think you might be interested in.

We monitor how you engage with our marketing communications.

Name, job title, membership organisation / company worked for, contact preferences, marketing preferences contact details, records of your interaction with our marketing campaigns.

Where you subscribe to newsletters or marketing communications, our legal basis for processing your personal data is consent.

In other cases we will rely on the lawful basis of having a legitimate interest in communicating with you about our services.

You always have the right to unsubscribe from marketing communications.

We have a legitimate interest in tracking the effectiveness of our marketing. This helps us create interesting and relevant content.

The LMA uses your personal data to record your interest in becoming a member, to register you as a member and to administer your membership.

Name, job title, membership organisation / company worked for, contact preferences, date of birth, gender, job function, job seniority, industry, connections with other people recorded in our membership records, social media and website profiles, unique ID, records of your engagement with the LMA (including group and event participation and attendance, interaction with our marketing campaigns, records of LMA resources you have accessed from our website), other notes made on your record (e.g. reasons for membership cancellation), dietary and accessibility information, payment records, profile picture.

We have a legitimate interest in processing your information in order to manage our relationship with you. This includes responding to enquiries about membership.

If you are a member then the processing is necessary for us to perform the contract for membership services. If the contract is with your organisation then we have a legitimate interest in processing your information to provide you with membership services.

We process dietary and/or accessibility requirements (including by sharing this information with relevant venue/caterers) based on your consent.

The LMA uses the personal data it holds to manage your involvement in a working party, committee or other project run by the LMA.

Name, job title, membership organisation / company worked for, contact preferences, details of the working party, committee or project with which you are involved including attendance records and records of contributions.

We have a legitimate interest in managing the working party, committee or other project for the benefit of the LMA, its members and wider stakeholders.

The LMA uses the personal data it holds to process and respond to requests, enquiries or complaints received from you or to deal with any account queries you may have.

Name, job title, membership organisation / company worked for, contact preferences, details of your enquiry or complaint.

We have a legitimate interest in dealing with such matters.

You, or your organisation, buy goods or services from the LMA (other than membership).

Name, job title, contact information, details of goods/services purchased, payment details.

If the contract is with you then the processing is necessary for our performance of the contract.

If the contract is with your organisation then we have a legitimate interest in processing your information to administer the business relationship between your organisation and the LMA.

We have a legitimate interest in processing your information to investigate and resolve disputes and to enforce our rights.

The LMA uses the personal data it holds to fulfil its legal obligations and to maintain proper business records.

Name, job title, membership organisation / company worked for, contact preferences, marketing preferences contact details, any other personal data relevant to the specific legal obligation.

Processing is necessary for the LMA to comply with the legal obligation.

The LMA has a legitimate interest in keeping other business records to administer its operations.

Event attendees

Scenario

Categories of personal data

Lawful basis

The LMA uses the personal data it holds to register and manage your attendance at an event.

Name, job title, membership organisation / company worked for, contact details, details of event being attended, profile picture / biography, passport details (where required by the venue operator).

Dietary and/or accessibility requirements.

This processing is necessary for us to perform our contract with you. Otherwise, if the contract is with your organisation, then we have a legitimate interest in processing your personal information for the purpose of managing the contractual relationship between your organisation and us. In each case, this includes taking pre-contractual steps, such as collecting details from you prior to enrolment and payment for attendance at the event.

For speakers at certain events, we have a legitimate interest in sharing a copy of your passport with our local agent to secure a permit to hold our event.

We process dietary and/or accessibility requirements (including by notifying the venue/caterers) based on your consent.

We may share delegates’ information with:

other delegates;
sponsors and prospective sponsors;
exhibitors and prospective exhibitors; and
speakers and prospective speakers.

Name, job title, employer, record of attendance.

Events apps (such as CrowdComms) profile information: Name, job title, employer, email address.

For in-person events that do not use an events app such as CrowdComms, if you ask us to, we share your information with other delegates based on your consent.

For online events, and for events using an events app such as CrowdComms, we have a legitimate interest in making your contact information available to other delegates to foster community interaction and to generally assist attendees with communicating with one-another using the online event platform. For events using an events app such as CrowdComms, you can opt-out of appearing on the delegate list by changing your settings within the app.

We have a legitimate interest in sharing your information with (prospective) sponsors, (prospective) exhibitors and (prospective) speakers for all events in order to: attract relevant sponsors for the event, help exhibitors select events which are relevant to their marketing objectives, help speakers tailor their material to the audience, and help speakers and exhibitors identify missed connections.

You attend an event with ID-scanning technology and consent to having your delegate ID scanned by an exhibitor.

Name, job title, employer, record of attendance.

We will share your information with that organisation based on your consent.

We may contact you after the event to ask you questions about your experience at the event.

Name, job title, contact details, record of event attended, feedback on event.

We have a legitimate interest in carrying out surveys to gauge the success of our events.

We take photos and video footage of our events to use on our website, social media channels and in general promotional materials. Presentations and speeches at events may be recorded and these recordings may feature crowd shots. You can speak to a member of staff if you do not want to be included in the photos/footage.

Appearance, location information.

We have a legitimate interest in taking photos and footage of our events to promote our events and the LMA’s work generally.
We have a legitimate interest in recording presentations and speeches so they can be viewed after the event.

Suppliers

Scenario

Categories of personal data

Lawful basis

You or your organisation supplies or offers to supply goods or services to us.

Name, job title, employer, contact information, payment details, details of staff involved in delivery of goods/services.

We have a legitimate interest in keeping a record of the contract between us (or your organisation and us) for the administration of our business and to address any disputes which may arise between us.

Mentoring scheme participants

Scenario

Categories of personal data

Lawful basis

You are a mentor or mentee in one of the LMA’s mentoring schemes.

We share mentee data with mentors and other people administering the scheme.

We share mentor data with their matched mentee and with other people administering the scheme.

Name, contact information, record of participation, feedback on the scheme, location, job information including current employer, team, role/title, relevant previous roles, key areas of specialism, years of industry experience, languages spoken, and personal interests.

We have a legitimate interest in processing your information to operate the mentoring scheme.

We share your information with the following people

The LMA’s Service providers. Your information may be shared with our external service providers. This includes our software and IT service providers, professional advisers and consultants. Our service providers are contractually bound to keep your information confidential.
LMA.Automate Limited. LMA Automate (company number 12977361) is a wholly owned subsidiary of the LMA. This sharing happens if you are a member and you use our document automation services which are provided by LMA.Automate. Please click here to see a copy of the LMA.Automate privacy notice for more information about how they process your personal data.
Your employer. If you are an LMA member then we routinely share information about you with your employer in order to administer your membership. Through our membership platform, your organisation also has access to details of your membership of any LMA working parties and your attendance at LMA events.
If you are a delegate at one of our events: other delegates, sponsors, exhibitors and speakers. If you register your interest to attend an LMA event then, unless you have opted out, we may share your name, job title and employer with the following groups of people:
- Other delegates: for online-only events, delegates can see one-another’s profile information from within the software used to host the event. For in-person events which use an events app such as CrowdComms, delegates can see one-another’s profile information. You can opt-out of appearing on the delegate list within the app by changing your preferences inside of the app.
- Sponsors and prospective sponsors: we may share delegate lists with sponsors and prospective sponsors to attract relevant sponsors for our events.
- Exhibitors and prospective exhibitors: we may share delegate lists with exhibitors and prospective exhibitors to help them select events which are relevant to their marketing objectives, to help them identify missed connections and to help connect delegates and exhibitors who have mutual business interests. Additionally, if you allow an exhibitor to scan your event ID then we will share your profile information with them after the event via the ID scanning platform.
- Speakers: we may share delegate lists with speakers to help them customise their presentations to the composition of the audience.

You can opt-out of this sharing by contacting us using the details set out above.

These groups of people are data controllers of your information once we share it with them. Please check their privacy notices to understand how they process your information. Our contracts with these people restrict how they use your personal data and ensure they process it lawfully.

International transfers of personal data

The information that we collect is stored and processed in the United Kingdom ("UK") and the European Economic Area ("EEA"). If we share your personal data with someone outside of the UK or EEA (e.g. to one of our service providers or an event venue) then we will ensure that transferred information continues to be protected by appropriate safeguards (usually Standard Contractual Clauses (SCCs)).

If you attend an event outside the UK and EEA, then we may transfer your name, contact details and, in some cases, passport details and dietary and/or accessibility requirements to the operator of the venue for the event. Where the recipient is based in a ‘third country’, the LMA relies on Article 49(1)(b) of UK GDPR and EU GDPR (as applicable). This allows the LMA to transfer your personal data internationally, on an occasional basis, because it is necessary for the performance of the contract between the LMA and you for your attendance at the event.

If you permit an exhibitor to scan your event ID then we will share your contact information with the exhibitor after the event. If the other person is based in a third country then the LMA relies on Article 49(1)(b) or 49(1)(c) of UK GDPR and EU GDPR (as applicable), because the transfer is necessary for performing the events contract which has been entered into for your benefit.

Your rights in respect of your data
Under UK and EU data protection law you have the following rights:

The right to be informed about what we do with your information. This notice provides you with this information.
If we are processing your data on the basis of your consent then you have the right to withdraw that consent at any time. Consent can be withdrawn by notifying us using the details set out at the start of this notice. Consent to marketing communications can be withdrawn by following the steps outlined in that communication, such as clicking the ‘unsubscribe’ link in the marketing emails we send.
The right to access a copy of your information which we hold. This is called a ‘data subject access request’. Additional details on how to exercise this right are set out in the ‘Access to Information’ section below.
The right to prevent us processing your information for direct marketing purposes. You can exercise your right to prevent such processing by checking certain boxes on the forms we use to collect your data or by contacting us using the details set out at the start of this notice.
The right to object to decisions being made about you by automated means.
The right to object to us processing your personal information in certain other situations.
The right, in certain circumstances, to have your information rectified, blocked, erased or destroyed if it is inaccurate.
The right, in certain circumstances, to claim compensation for damages caused by us breaching data protection law.
The right, in certain circumstances, to request that we erase, rectify, cease processing and/or delete your information.

You have the general right to complain to us in the first instance if you are not happy with how we are processing your personal information. If you are not satisfied by our response then you can complain to the Information Commission (IC) via www.ico.org.uk in the UK or your local data protection regulator if you are in the EEA.

Access to information

Under UK and EU data protection law you can exercise your right of access by making a written request to receive copies of some of the information we hold on you. We may need to request proof of your identity, or proof of your authority (if making the request on behalf of someone else), before we can supply the information to you. Requests should be sent to us using the contact details set out at the start of this policy.

You do not need to pay a fee to exercise this right unless you are requesting copies of documents you already possess, in which case we may charge our reasonable administrative costs. We are also allowed to charge you for our reasonable administrative costs in collating and providing you with details of the requested information which we hold about you if your request is clearly unfounded or excessive. In very limited circumstances, we are entitled to refuse to comply with your request.

In certain circumstances, you are entitled to receive the information in a structured, commonly used and machine-readable form.

Data retention

We retain personal data for as long as your LMA account is active and otherwise as long as needed to fulfil the purposes for which it was collected (for example to operate your account).

We will keep your data for longer periods if we have a legal obligation to do so or if necessary to resolve disputes or enforce our agreements or legal rights.

If you provide us with passport details to share with the operators of venues for events, we will delete all details promptly following the event.