It is designed to inform you about how we collect and use your personal data, and is divided into the following sections:

1. What personal data do we collect?
2. Special categories of personal data
3. Legal bases for processing your personal data
4. Why we collect personal data
5. Disclosures to third parties
6. How we protect your personal data
7. Data retention
8. Your rights in relation to your personal data
9. How to stop hearing from us
10. Our copyright statement
11. Changes to this privacy notice

We take our responsibility for the privacy and security of your personal data very seriously.  This privacy notice tells you what to expect when we collect and process your personal data.  We will ensure that:

• any personal data you provide to us or we receive from other organisations is kept safe and secure;
• we will be clear about our reasons for collecting and processing it; and
• we will not do anything with it that you wouldn’t reasonably expect.

You have the right to complain to the Information Commissioner’s Office (ICO) if you have a concern about how we process your personal data and you can do this via ICO Concerns.

Our privacy notice is set out below. Please read this with care; it describes how we will process your personal data and what we will use it for.

Contacting Us

If you have any enquiries, questions or concerns about the information contained in this privacy notice or more generally about how we collect and use your personal data, you can address these online through contact us or via email to info@asbof.co.uk, in writing to the Secretary (who acts as the contact for all entities listed), ASBOF, 12 Henrietta Street, London, WC2E 8LH, or by calling us on 020 7340 0210.

1. What personal data do we collect?

There are a number of scenarios where we collect personal data about you. In most instances, these are where you choose to provide personal data to us. We set out the different scenarios below:

Submitting an enquiry

If you submit an enquiry to us, the ASBOF and BASBOF will collect the following information to process your complaint:

• Your name (including first name and last name)
• Your contact details (including email address and contact number)
• Your company
• Your message
• Any additional personal data you provide in your message

Advertising levy collection

ASBOF and BASBOF collects the advertising levy from ad agencies and media companies; it also collects digital advertising levies from those who have signed up to the scheme through the major digital platform providers such as Google; if you are an ad agency / media company or have volunteered to pay the levy, ASBOF and BASBOF will collect the following information to manage the collection and recording of the advertising levy:

• Your name (first name and last name)
• Your work contact details (including email address and contact number)
• Your employer and job title (if appropriate)
• Your personal contact details (if you trade under your own name i.e. Bill Smith Ltd)

Directors’ information

If you are acting as a director of ASBOF / BASBOF then we will collect the following information to manage our relationship with you and ensure that you are kept up to date with important information about your role:

• Your name (first name and last name)
• Your work contact details (including email address and contact number)
• Your employer and job title
• Your personal contact details (including email address and contact number)
• Your nationality
• Your date of birth

Suppliers

If you supply ASBOF with any service i.e. IT Support or stationery, then ASBOF and BASBOF will collect the following information to manage the supply of the service including payment of invoices:

• Your name (first name and last name)
• Your work contact details (including email address and contact number)
• Your employer and job title
• Your bank payment details (including bank name, account number and sort code)
• Your personal contact details (if you trade under your own name)

Job applicants

If you apply for a role at ASBOF or BASBOF, we will collect the following information to enable us to process your application efficiently and provide you with additional information:

• Your name (forename, last name other names)
• Your title
• Your contact details (including email address and contact telephone number)
• Curriculum vitae

If you are selected for interview then we have a legal obligation to collect and process information which proves your right to work including references, a work permit, copy of a passport or a copy of a visa, and will do so on the basis of this legal obligation.

Through our website

Like most websites, we use “cookies” and other tracking technologies to help create a better experience for you when using it. Cookies allow a website to remember you; they are small text files that sites transfer to your computer (or phone or tablet). They make interacting with a website faster and easier – for example by automatically filling your name and address in text fields.

In addition, the type of device you’re using to access our website and the settings on that device may provide us with information about your device, including what type of device it is, what specific device you have, what operating system you’re using, what your device settings are, and why a crash has happened. Your device manufacturer or operating system provider will have more details about what information your device makes available to us and how you can control that.

2. Special categories of personal data

Data protection law defines special categories of personal data as personal data revealing:

• racial or ethnic origin;
• political opinions;
• religious or philosophical beliefs; or
• trade union membership;

These categories also include:

• genetic or biometric data processed for uniquely identifying individuals; and
• data concerning health, sex life or sexual orientation.

We will not ask you for this information, except if you apply for a job with us, at which point you can opt to ‘prefer not to say’; however, you may provide some of this information in support of your enquiry to us.  Please see Section 3 below for further information about the basis upon which we use special category data.

3. Legal bases for processing your personal data

The legal bases we will usually rely on are:

• legitimate interest; or
• consent (which may be explicit); or
• contract; or
• legal obligation.

Legitimate Interests

We set out below the key circumstances where we rely on the legitimate interest basis.

• In most instances, individuals supply us with their personal data with the intention and expectation that we will respond to their enquiry that they have made to us and provide them with a satisfactory outcome, and we therefore have a legitimate interest in processing their personal data for this purpose. We may also contact you, to request additional information that we may need about your enquiry. If your enquiry is about something that is not covered by our remit, we may be able to refer it to another regulatory body in the UK that could consider your enquiry.
• We have a legitimate interest in processing personal data provided to us in our role as the funding body for the UK advertising regulator investigating complaints, supplying copy advice, taking compliance and enforcement action and carrying out consultations. We cannot carry out our role without collecting the levy, which you have voluntarily agreed to pay, from individuals and organisations which necessarily involves the processing of personal data. We only collect the minimal amount of personal data necessary to carry out our role as the funding body for the UK advertising regulator and we put in place safeguards to ensure that any personal data provided to us is only used for limited purposes.
• We have a legitimate interest in processing personal data provided to us about the directors of ASBOF / BASBOF, including display of their images on our website, contacting them about important information about the collection of the advertising levy, the supply of the annual report and accounts as well as details of meetings of the board which they will attend. We collect the minimal amount of data for us to achieve this.  The data that is supplied to us is retained in the directors register which is secured and has limited access.  Directors have the right to object to their images being displayed on our website at any time.
• We also have a legitimate interest in working with our suppliers including contacting them to order materials, to follow up on orders or to query orders or delivery. The personal data we collect as part of this process is very limited but is necessary to ensure the efficient and effective management of our suppliers.
• In certain instances we will want to ensure that the personal data we hold on individuals is accurate. This is necessary for us when we are collecting the levy or working with our suppliers. Therefore we have a legitimate interest in accessing publicly available information found on Companies House, Post Office’s National Change of Address database, whois.com, websites and other reputable sources, to ensure that the records we hold about individuals is accurate.
• We also have a duty to provide a safe working environment for our staff. We have a legitimate interest to process personal data on individuals who behave in an unacceptable way towards our staff and we will, where we consider necessary and proportionate, restrict such individual’s ability to communicate with us.

You have a right to object to your personal data being used on the basis of legitimate interests. However, in most cases, we will not be able to operate effectively as the funding body for the ASA if you exercise this right to object. Alternatively we may have a compelling legitimate ground to continue to process your personal data in the context of our role as the funding body for UK advertising regulatory bodies despite your objection.

Contract

If you regularly supply services to us and are a sole trader we will need to process certain personal data in order to ensure efficient and effective management of the relationship that we have with you since this is necessary for performance of a contract.

Legal obligation

We have a legal obligation to collect, store and process directors’ personal data in accordance with our obligations under Companies Act legislation.

Explicit consent

While we do not intentionally seek to collect special category data, we recognise that in certain contexts this data may be supplied to us by you. In such circumstances, we will need to gain explicit consent from you before we process your enquiry any further unless we can rely on other conditions in the substantial public interest, for instance, complying with our regulatory requirements relating to unlawful acts or dishonesty.

4. Why we collect personal data

We collect personal data for the following purposes:

• To process the enquiry you have made to us
• To request additional information and provide feedback to you about your enquiry
• To identify you in relation to requesting additional information or feedback about your enquiry
• To manage suppliers that work with us supplying goods and services
• To manage the collection of the levy from ad agencies, media companies and where appropriate those that have agreed to pay the levy via the digital platform provider Google.
• To keep a record of your relationship with us including general communications
• To ensure we know how you prefer to be contacted
• To provide you with information and access to services that you have requested from us or which we feel may be of interest to you, where you have consented to be contacted for such purposes.
• To process an application for a role at ASBOF or BASBOF
• We may also use your personal data to detect and reduce fraud in order to protect our interests.

Job Applications

If you have applied for a role at ASBOF or BASBOF we will process your personal data on the basis of legitimate interest, provided at the point of application.  The application process may ask for / or you may voluntarily provide some special category data (e.g. religious or philosophical beliefs, race or ethnic origin, sexual orientation and disability) but you do not have to supply this; We do not use this data to report on the diversity of our applicants, those shortlisted and the offers made; however we do use this data to ensure that we maintain our principle of fairness and equal opportunity. In collecting and using this data, we rely on the ground of equality of opportunity or treatment.

5. Disclosures to third parties

We reserve the right to disclose your personal data to third parties:

• If we are under any legal or regulatory duty to do so; and/or
• to protect our rights, property or the safety of us, our personnel, users, visitors or others.

We also use third party service providers as our processors to only hold and use personal data on our behalf in order to provide us with a service.  We may also disclose personal data to our professional advisors and experts in order to obtain their assistance in carrying out our services and our activities.

6. How we protect your personal data

We have access to shared systems and data; all access to personal data is managed through individual access permissions, which means that individuals only have access to personal data when it is appropriate for them to do so (this is known as the principle of least privilege). Where an individual is unable to access personal data that they believe they have the right to, for their role, the requirement for their access to personal data is checked with their line management.

Your personal data is held on secure servers in the UK (although see below for backup data being held on servers in the USA) and we ensure that there are appropriate technical controls in place to protect your personal data.  For example, our online forms are always encrypted and our network is protected and routinely monitored. The transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your personal data when you transmit it to our site.

If we use external companies to collect or process personal data on our behalf, we undertake checks before we begin work with them, and put a contract in place that sets out our expectations and requirements e.g. non-disclosure agreements and expected levels of security; especially regarding how they manage the personal data they collect or have access to.

International data transfers

The European Commission has assessed a number of countries and determined that their data protection legislation has sufficient safeguards and is adequate to enable the transfer of personal data to recipients in these countries. Where a recipient of your personal data is based in a country which has not been declared adequate by the European Commission we will take all reasonable steps to implement appropriate safeguards in accordance with EU law on data protection.

For instance, we backup your data at the close of each working day; the data is backed up to a third party supplier based in the USA.  Therefore some of your personal data will be held on servers in the USA.  We have taken reasonable steps, including checking the actions they have taken to protect your personal data in line with the requirements of GDPR and have determined that they meet the standards required.  Before the data is transferred it is encrypted using an industry standard algorithm, controlled by password authentication which is only available to limited Asbof staff;  a unique key is created for each file and the key is never available to organisation storing the data.  In addition to this a method is used as a digital signature, to confirm that when the data is received back, it has not been altered.

7. Data retention

When you supply personal data to us to handle your enquiry or record that you have voluntarily agreed to pay the advertising levy, we will retain it in line with our data retention policy.  Personal data is retained for the purpose and the length of time necessary for which it was collected i.e. to handle the enquiry. We may also be under a legal obligation to retain personal data for a specific period and compliance with our legal obligation may limit the right of an individual to have their personal data erased.  Where you exercise your rights under data protection law (e.g. the right to have your personal data erased) and this conflicts with any requirement or need for us to retain personal data you will be advised that this is the case and we will give you the timeframe within which we expect to comply with your right.

8. Your rights in relation to your personal data

You have the right to be informed about what personal data is collected and how that is used; this information is contained in this privacy notice in the section ‘What personal data do we collect’.

You have the right to ask us to erase all the personal data that we hold about you, and if it is no longer necessary for the purpose for which you provided it to us (e.g. processing your enquiry) and it is lawful for us to do so, we will erase your personal data and provide you with the outcome of that process.

You have the right to object to our processing of your personal data, to stop us processing your personal data or restrict processing of your personal data, and if it’s no longer necessary for the purpose for which you provided it to us (e.g. processing your enquiry or registering you for advertising levy) we will do so.  Please contact us if you have any concerns.

You have a right to ask for a copy of the personal data we hold about you, although if the effort to provide such personal data is disproportionate (because of manifestly unfounded or excessive requests) then we may charge for processing these requests.

You have the right to have your personal data rectified, where it is shown to be inaccurate or incomplete; if there are any discrepancies in the personal data we use about you, please let us know and we will correct it.

You have the right to seek portability of your personal data in certain circumstances where we are relying on the lawful bases of consent or performance of a contract to process your personal data.

If you want to access your personal data, please send a description of the personal data you want to see to info@asbof.co.uk or write to the Secretary at ASBOF, 12 Henrietta Street, London, WC2E 8LH. We may request proof of identity to ensure that we only provide the personal data to the right person.

If you have any questions or wish to exercise any of your rights please contact info@asbof.co.uk, and for further information see the Information Commissioner’s guidance here (link is external).

9. How to stop hearing from us

If you decide that the information we provide to you is no longer relevant or interesting to you and you do not wish to hear from us any more, it would be useful for us to understand the reasons; you may change your contact preferences at any time by emailing us at info@asbof.co.uk, or calling us on 0207 340 0210 or writing to us at ASBOF, 12 Henrietta Street, London, WC2E 8LH.

10. Our copyright statement

All material either on this website or provided in hard copy is owned by or licensed to the ASBOF or BASBOF, and is protected by registered and/ or unregistered trademark rights, copyright, or other proprietary rights and laws.

Unless indicated as Crown-owned material or otherwise, the material featured on this website or provided in hard copy may be reproduced free of charge in any format or medium, provided that it is reproduced accurately and not used in a misleading context. The material must be acknowledged as ASA copyright and the title of the document/publication specified.

Any enquiries regarding the material on this website should be addressed by email to info@asbof.co.uk or by letter to The Secretary, ASBOF, 12 Henrietta Street, London, WC2E 8LH.

11. Changes to this privacy notice

If we decide to change our Privacy Notice, we shall post changes on this webpage and update the relevant sections in our publications where we display how we use your personal data so that you are always aware of how ASBOF and BASBOF use your personal data. If we make significant changes to our Privacy Notice, we will use reasonable efforts to contact you to notify you of such changes.

This page was last updated on 15^th January 2019