If you have been referred to this page when applying for services or finance, or in the context of being
employed by or working for an organisation, then please go to the Fair Processing Notices for Cifas' Databases page
1. Introduction and general terms
This website is operated by Cifas, a company registered in England and Wales under company number 02584687 and
with our registered office at 6th Floor Lynton House, 7-12 Tavistock Square, London WC1H 9LT
(“Cifas”, “we”, “us” or “our” in this policy). Where we
decide the purpose and means for which personal data you supply through this website is processed, we are the
The Compliance Officer
6th Floor, Lynton House
7 - 12
relates to our use of any personal information you provide to us through this website and any other electronic
communications networks such as emails.
- What information Cifas may collect about you;
- How Cifas will use information we collect about you;
- When Cifas may use your details to contact you;
- Whether Cifas will disclose your details to anyone else;
- Your choices and rights regarding the personal information you have provided to us;
Whenever you provide personal information, we are legally obliged to use your information in line with the
General Data Protection Regulation and the Data Protection Act 2018 (referred to collectively in this privacy
policy as “data protection legislation").
This website contains hyperlinks to websites owned and operated by third parties. These third party websites have
their own privacy policies, including cookies, and we urge you to review them. They will govern the use of
personal information you submit or which are collected by cookies whilst visiting these websites. We do not
accept any responsibility or liability for the privacy practices of such third party websites and your use of
them is at your own risk.
2. What information will Cifas collect about me?
We collect and process the following information which may include your personal data.
Information about your use of our services
When you contact us regarding one of our services, such as Training or Speakers for Events, the forms you
complete may include information about you. This can include your name as the contact point for an organisation,
your email address and the organisation's address.
- We process this to provide services you request under an agreement between us, or to take steps you request
prior to entering such an agreement;
- If you don’t provide all relevant information, we may not be able to provide you with the services you
- We only process this to take such steps, or providing such services;
- We delete this information 6 years after we finish supplying any services, or
after 12 months if you decide not to take up any services.
When you submit a job application through our website, the application forms we ask you to complete include
personal data about you.
- We process this to take steps you request prior to entering into an employment contract with you (if you are
- We only process this for the purpose of your application;
- If you don’t provide all relevant information, we may not be able to process your job application;
- We delete this information 6 months after your application is received, if you
are not offered a role or do not wish us to keep hold of your details in case future opportunities arise.
If you are successful, we will retain the information in accordance with your employment contract and our
internal data protection policies, which will be notified to you in the course of the application process.
When you email us for further information on topics such as Internal Fraud or Protective
Registration, you will be providing us with your email address and any other information you include in
- We only process this in order to pursue our legitimate interests in supplying you with information about
fraud prevention and the services we offer;
- We delete this information 6 years after we have finished supplying you with any
services, or after 12 months if you do not take up any services.
How you use our website (analytics)
addresses, and responses to polls we might post on the website, to help analyse how visitors use the site and to
compile statistical reports on website activity. Our site also uses Google Analytics and you can find out more
Google uses data when you use our partners' sites or apps". To learn how to opt out of Google Analytics
please visit Google
Analytics Opt-out Browser Add-on or your Google Ads Settings.
- We process this information to understand how visitors use our website and to compile statistical reports
regarding that activity (for example, your IP address is used to approximate the country from which you
access our website, and we aggregate this information together so we know that, for example, most of the
visitors to our website come from England);
- This processing is necessary for us to pursue legitimate interests in improving our website, and providing a
better service and source of information to visitors;
- This information is not used to develop a personal profile of you. All such information is stored
anonymously. We use the masking setting within Google Analytics to anonymise IP addresses;
- Where any cookies can be used to single-out your device when you are using our website, that identifier is
deleted (at the end of each day).
We may use third party analytics providers, in particular, Google Analytics. Before we do so, we will ask
for you to give your consent.
All our website financial transactions are handled through our payment services provider, Protx, a division of
Sage (UK) Limited.
- We need to process this personal data in order to provide you with services you have requested under an
agreement between us, or in order to take steps you have requested prior to entering into such an agreement;
- We process this personal data by sharing it with Protx only to the extent necessary for the purposes of
processing payments you make via our website;
- When payment is taken, no details are held in session storage or cookies. Card details are sent directly to
the bank clearing process via a secure link and only responses (i.e. “success” or
“failure” regarding your payment) are recorded;
- We keep these transaction records for 6 years.
All content you submit to us
If you send offensive, inappropriate or objectionable content to cifas.org.uk, or otherwise engage in any
disruptive behaviour on cifas.org.uk, Cifas may process your personal data as might be included in such message
to stop such behaviour.
- We only process personal data in this way for the legitimate interests of ensuring that use of our website
is lawful, does not disrupt the operation of our website, does not harass our staff or other individuals,
and to enforce our legal rights and to comply with our legal obligations;
- Where Cifas reasonably believes that you are or may be in breach of any of the laws of England or Wales (for
instance, because content you have sent may be defamatory), Cifas may use your personal information to
inform relevant third parties such as your email/internet provider or law enforcement agencies about the
Cifas will not (and will not allow its website provider to) use the information and/or any statistical analytics
tool to track or to collect any personally identifiable information about visitors to our site. We will not
associate any data gathered from this site with any personally identifying information from any source.
Where Cifas proposes using your personal information for any other uses we will ensure that we notify you first.
You will also be given the opportunity to withhold or withdraw your consent for uses other than those listed
3. Your rights in relation to personal data which we process relating to you
You have the following rights over the way we process personal data relating to you. We aim to comply
without undue delay, and within one month at the latest.
(i) to ask for a copy of data we are processing about you and have inaccuracies corrected
- Data protection legislation gives you the right to request a copy of the personal information we hold about
you and to have any inaccuracies corrected;
- Our Data Subject Access Request
page explains how to make a request to us;
- We will use reasonable efforts to the extent required by law to supply, correct or delete personal
information held about you on our files (and with any third parties it has been disclosed to);
(ii) to object to us processing data about you
You can ask us to restrict, stop processing, or to delete your personal data if:
- You consented to Cifas processing the personal data, and have withdrawn that consent;
- Cifas no longer needs to process that personal data for the reason it was collected;
- If Cifas is processing that personal data because it is in the public interest or in order to pursue a
legitimate interest of Cifas, you don’t agree with that processing, and there is no overriding
legitimate interest for us to continue processing it;
- If the personal data was unlawfully processed;
- If you need the personal data to be deleted in order to comply with a legal obligations;
- If the personal data is processed in relation to the offer of a service to a child;
- In which case, you can let us know by email to email@example.com.
(iii) to obtain a machine readable copy of your personal data, which you can use with another service
- If we are processing data in order to perform our obligations to you, or because you consented, if that
processing is carried out by automated means, we will help you to move, copy or transfer your personal data
to other IT systems;
- If you request, Cifas will supply you with the relevant personal data in a format which is readily
accessible by most IT systems (CSV format). Where it is technically feasible, you can ask Cifas to send this
information directly to another IT system provider if you prefer;
- To make a request let us know by email to firstname.lastname@example.org.
(iv) to make a complaint to the Information Commissioner’s Office
- If you are unhappy with the way Cifas is processing your personal data, please let us know;
- Or, if you do not agree with the way we have processed your data or responded to your concerns, an
alternative is to submit a complaint to the Information Commissioner’s Office, through their website
or by post or live chat. Find out
3. Will Cifas share my personal information with anyone else?
We keep your information confidential, but may disclose it to any of our employees, officers, agents, suppliers
or subcontractors insofar as it is reasonably necessary for the purposes as set out in this privacy
We will share information with our payment services provider, Sage Pay Europe Limited, and Google, Inc., as
described in section 2.
In addition, we may disclose your information to the extent that we are required to do so by law (which may
include to government bodies and law enforcement agencies); in connection with any legal proceedings or
prospective legal proceedings; and in order to establish, exercise or defend our legal rights (including
providing information to others for the purposes of fraud prevention).
Except as provided above, we will not provide your information to third parties.
4. What if I am aged 16 or under?
If you are aged 16 or under, please get your parent/guardian's permission beforehand whenever you provide
personal information through the Cifas website. Users without this consent are not allowed to provide us with
5. How long will Cifas keep my personal information?
We will hold your personal information on our systems for as long as is necessary for the relevant service, or as
6. Security of my personal information
We will take all reasonable technical and organisational precautions to prevent the loss, misuse or alteration of
your personal information.
information through the website. The date of the most recent revisions will appear on this page.
8. Information about cookies
A cookie is a small piece of information sent by a web server to a web browser, which enables the server to
collect information from the browser.
Find out more about the use of
Most browsers allow you to turn off cookies or to receive a warning before a cookie is stored on your hard drive.
Please refer to your browser instructions or help screen to learn more about how to do this. If you decide to
disable any cookies we place on your computer, you may not be able to use certain services or facilities on the
Last updated: December 2018