Our contact details
Name: Office of the Complaints Commissioner (trading as Financial Regulators Complaints Commissioner (FRCC). Companies House Registration Number: 517130 | ICO Registration Number: Z8930474.
Address: Alliance House, 12 Caxton Street, London, SW1H 0QS
Phone Number:+44 20 4599 8333. We use a telephone bureau to take inbound calls (further information below).
E-mail: info@frccommissioner.org.uk
The FRCC is the Controller. Our dedicated data protection representative can be contacted on info@frccommissioner.org.uk.
1. What categories of information we have
We collect and process the following information about you (you includes complainants and relevant third parties, representatives contacting us on behalf of complainants and anyone who contacts us by email or telephone with general enquiries):
We process information related two different streams of work:
In relation to matters that fall within the remit of the Complaint Scheme and are formally investigated:
- Personal identifiers, contacts and characteristics (for example, full name, email address, telephone and mobile number, postal address, IP address);
- Recordings of phone calls;
- Details of complaints and any relevant information provided to us by you and/or the regulators or any other relevant body;
- We ask that you do not provide us with special category personal data (such as specifics about your disability or medical condition) when making a request for reasonable adjustments or at all, unless this information is pertinent to the substance of your complaint. We will make adjustments when it is within our power to do so.
In relation to matters that do not reach formal investigation stage (complaint at Stage 1 with the regulator) or fall outside of the remit of the Complaint Scheme:
- Personal identifiers, contacts and characteristics (for example, full name, email address, telephone and mobile number, postal address, IP address ;
- Recordings of phone calls;
- Information you provide us with, which is not relevant to the functions and operation of the FRCC.
2. How we get the information and why we have it
The personal information we process is provided to us directly by you for one of the following reasons:
In relation to matters that fall within the remit of the Complaint Scheme and are formally investigated:
- To ensure that we can effectively log, investigate and assess complaints about the regulators;
- To enable us to provide you with service communications about the investigation we are undertaking, the performance of our Website or any surveys we are undertaking in relation to the Commissioner’s work;
- Cookies are used to ensure the proper operation of our website. IP addresses of the devices you use to access the Website are recorded through the use of “Essential/ Necessary Cookies”. For further information about the types of Cookies we use, please visit our Cookie Policy;
- We record phone calls for record keeping, training and quality assurance purposes. The inbound telephone service is delivered by Best Reception, whose Privacy Notice can be accessed here. Outbound calls are recorded on WebEx, whose Privacy Notice can be found here.
We also receive personal information indirectly, from the following sources in the following scenarios:
- The regulator your complaint relates to; and
- Any other third-party we may need to make enquiries with.
In relation to matters that do not reach formal investigation stage (complaint at Stage 1 with the regulator) or fall outside of the remit of the Complaint Scheme:
- To maintain a statistical record of all correspondence dealt with in any financial year;
- Cookies are used to ensure the proper operation of our website. IP addresses of the devices you use to access the Website are recorded through the use of “Essential/ Necessary Cookies”. For further information about the types of Cookies we use, please visit our Cookie Policy;
- Any information you provide about your complaint or concern.
Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (the Data Protection Legislation), the lawful basis we rely on for processing this information are:
- Consent to receive surveys. You are able to withdraw your consent at any time. You can do this by telling us through email at any time before the conclusion of your complaint.
- Performance of a task in the public interest;
- Compliance with a legal obligation;
- The processing of personal data is in the vital interest of the data subject;
- We have a legitimate interest.
3. What we do with the information we have
In relation to matters that fall within the remit of the Complaint Scheme and are formally investigated:
We use the information that you or the regulators or relevant third parties have given us in order to process your complaint and carry out day-to-day service-related tasks.
We use call recordings to support our investigations, to ensure that the service we provide over the telephone meets our high standards and to provide training to our staff where appropriate.
In relation to matters that do not reach formal investigation stage (complaint at Stage 1 with the regulator) or fall outside of the remit of the Complaint Scheme:
We will try to direct you to the correct organisation by providing you with their details. Personal data is not processed for any other purpose.
4. Sharing your information
We may share information with the Regulator your complaint relates to.
In certain circumstances we may also be obliged to share your personal data with third parties such as public authorities and law enforcement agencies.
We use data processors who are third parties who provide elements of services for us, such as contractors and consultants who help us in completing investigations, processing data subject requests, and providers of services such as an inbound call centre, Customer Record Manager platform (CRM), IT and Website maintenance. We have contracts in place with our data processors. This means that they cannot do anything with your personal information unless we have instructed them to do it.
They will not share your personal information with any organisation apart from us. They will hold it securely and retain it for the period we instruct. When it is necessary for us to transfer your personal information outside of the UK this will only be done in accordance with the UK GDPR.
5. How we store your information and for how long
Your information is securely stored on our secure Azure Cloud platform, with servers located in the European Economic Area (EEA). Azure servers provide the highest levels of security, which is supported by our own internal security measures, such as multi-factor identification, data protection policies and procedures, as well as appropriate data protection training for our staff.
Unfortunately, the transmission of information via the world-wide web is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of this data transmitted and any transmission is at your own risk.
In relation to matters that fall within the remit of the Complaint Scheme and are formally investigated:
We keep:
| Type of personal data | Retention Period |
|---|---|
| Name of complainants when a Final Decision is issued (linked to Anonymised Final Decision) | Indefinitely |
| Contact details | Anonymised after six months from the date of the Final Decision being issued (whether communicated to you via a Report, letter, email or phone call) if no other ongoing communications are taking place.
If communications are ongoing following a final decision, these details will be anonymised within six months of the conclusion of these. |
| Call recordings | Best Reception: 12 months from the date of recording
WebEx: 12 months from the date of the Final Decision |
| The information identified during the investigation of your complaint as pertinent and which forms the basis of the final decision, either provided by you or the Regulators | Deleted 6 months after the issuing of a Final Decision. (Please note, paper files provided cannot be returned and are always securely shredded. Only pertinent information will be retained in electronic format) |
| Any information provided by you, the Regulators or any other relevant third-party during the course of the investigation which was not relied upon to make the decision | Deleted after the date of issuing the Final Decision or within one month in any event |
| Anonymised Final Decision | Indefinitely |
| Post Final Decision correspondence (unless deemed pertinent and/or necessary) | Not entered onto our CMS and not retained |
| Repetitive correspondence | Not entered onto our CMS and not retained |
| Information relating to service complaints about the Commissioner’s office and staff | Three months from the date of responding to the complaint, unless the complaint is upheld
In the event of the latter, we will anonymise as much of the data as possible but some personal data, such as call recordings, will be retained for HR purposes in accordance with employment law as applicable from time to time |
| Data Subject request, including Subject Access Request and Data Breach logs | Anonymised after 12 month of the response date |
| Personal Information provided to the data subject in response to a DSAR | Deleted after 12 months of the response |
| Data related to Judicial Review Proceedings | 3 months from the conclusion of legal proceedings |
| IP addresses and Cookie data | In line with the information set out in our Cookie Policy |
In relation to matters that do not reach formal investigation stage (complaint at Stage 1 with the regulator) or fall outside of the remit of the Complaint Scheme:
| Type of personal data | Retention Period |
|---|---|
| Name of complainants | Anonymised every six months and the anonymised record will be kept for statistical purposes only |
| Contact details | Anonymised every six months |
| Call recordings | Best Reception:12 months from the date of recording
WebEx: 12 months from the date of the Final Decision |
| Repetitive correspondence | Not entered onto our CMS and not retained |
| Information relating to service complaints about the Commissioner’s office and staff | Three months from the date of responding to the complaint, unless the complaint is upheld
In the event of the latter, we will anonymise as much of the data as possible but some personal data, such as call recordings, will be retained for HR purposes in accordance with employment law as applicable from time to time |
| Data Subject request, including Subject Access Request and Data Breach logs | Anonymised after 12 months of the response date |
| Personal Information provided to the data subject in response to a DSAR | Deleted after 12 months of the response |
| Data related to Judicial Review Proceedings | Three months from the conclusion of legal proceedings |
| IP addresses and Cookie data | In line with the information set out in our Cookie Policy |
We will then dispose of your information by shredding it, permanently deleting it from our systems and backup, and requiring our processors to permanently delete it from their systems and backups.
6. Your data protection rights
Under the Data Protection Legislation, you have rights including:
- Right of access – You have the right to ask us for copies of your personal information, including information about how and why we process it.
- Right to rectification – You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete. This right is not absolute.
- Right to erasure – You have the right to ask us to erase your personal information in certain circumstances. This right is not absolute.
- Right to restriction of processing – You have the right to ask us to restrict the processing of your information in certain circumstances.
- Right to object to processing – You have the the right to object to the processing of your personal data in certain circumstances.
You are not required to pay any charge for exercising your rights, unless this would impose a disproportionate operational burden on our organisation or you are making repeat requests. If you make a request, we have 30 calendar days to respond to you in most cases.
Please contact us at info@frccommissioner.org.uk if you wish to make a request.
7. Links to other websites
This Website may, from time to time, provide links to other websites. We have no control over such websites and are not responsible for the content of these websites. This Privacy Notice does not extend to your use of such websites. You are advised to read the Privacy Notice or statement of other websites prior to using the app.
8. How to complain
You can complain to us through the dedicated data protection representative (details above). Should you remain unhappy with how we process your personal data, you can also complain to the ICO.
The ICO’s address:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Helpline number: 0303 123 1113
May 2023