Privacy Notice

The Money Advice Trust “The Trust” is a charity founded in 1991 to help people across the UK tackle their debts and manage their money with confidence. The Trust’s main activities are giving advice, supporting advisers and improving the UK’s money and debt environment. We give advice and information to people concerned about their debts through our National Debtline service and the equivalent service to small businesses through our Business Debtline service. We support advisers by providing training through Wiseradviser and recognise innovation debt advice projects through our Innovation Grants. We use the intelligence and insight gained from these activities to improve the UK’s money and debt environment by contributing to policy developments and public debate around these issues.

CASHflow is an online tool that can help advisers to support people with debt to do their own household budget and use it to make repayment offers to their creditors themselves.

The Trust (“we” or “us”) take the privacy of your information very seriously. This notice explains how and for what purposes we use the information collected about you.

The Trust looks after the information it holds about you, and respects your privacy. We take appropriate security precautions to prevent your information being lost or falling into the wrong hands.

We make sure that the information we hold is as accurate as possible; we do not hold more information than we need; and we do not hold it longer than we need to.

We keep records of all personal data that we process ensuring we have identified and documented a legal basis for processing the data.

We do not share your data with anyone else without your permission, except when we believe it is the only way to prevent harm to you or other people. If we do disclose information without your permission, this is authorised by a senior member of staff, and we will explain our reason to you at the earliest opportunity.

This privacy notice details the way in which we will treat your information, your rights in relation to it, and how we will ensure that your data is kept safe, secure and in your control. It will do this for all the ways in which you choose to access our service.

If you have any queries about this notice or anything to do with how we treat your data, please get in touch with us by using the contact details at the bottom of this notice.

Information collected

We will collect certain information from you which is required to register with CASHflow including e-mail address and a password.

We may also hold the following information about you:

Information that you provide when you create a financial statement on CASHflow. This includes information about your income and expenditure, creditors, and your address.

Information about a problem that you report with CASHflow.

If you contact us, we may keep a record of that correspondence.

The debt advisory service that invited you to use CASHflow may access your information through its own licence. Any creditor to whom you give a financial statement prepared through CASHflow may also access your information with an appropriate licence.

Information automatically collected from your computer

Log files/IP addresses: When you visit the site our web server automatically records your IP address. This IP address is not linked to any of your personal information. We use IP addresses to help us administer the site, to collect demographic information and to find out such things as how many people are visiting particular pages on our site. Our website may also use a website recording service which may record mouse clicks, mouse movements, page scrolling and any text keyed into website forms. Data collected by this service is used to improve our website usability. The information collected is stored and is used for aggregated and statistical reporting, and is not shared with anybody else. We may also gather other non-personal information (from which we cannot identify you) such as the type of your internet browser which we use to provide you with a more effective service.

Cookies: For a comprehensive overview of how we use cookies please refer to our Cookies Policy.

Use of this information: We will use some of this information in order to:

carry out marketing analysis and make general improvements to our site;

analyse how users are making use of the site; and

obtain your views or comments on the information and advice we provide.

We may collate anonymous data which is shared with our partner agencies, funders and the government. This is to enable us to demonstrate demand and use of the site.

We cannot be responsible for the privacy policies and practices of other sites even if you access them using links from CASHflow and recommend that you check the policy of each site you visit and contact its owner or operator if you have any concerns or questions.

In addition, if you linked to this site from a third party site, we are not responsible for the privacy policies and practices of the owners or operators of that third party site and recommend that you check the policy of that third party site and contact its owner or operator if you have any concerns or questions.

The Trust and how we treat your data

The Trust is committed to good practice in the handling of personal data and careful compliance with the requirements of the Data Protection Act (1988) (references to the DPA shall include, to the extent applicable, the General Data Protection Regulation 2016/679.

The Trust is committed to good data management in order to protect people from harm. This means:

  • keeping information securely in the right hands
  • holding good quality information
  • obtaining explicit consent from our clients to record and process their data

The Trust also ensures that it takes into account the legitimate concerns of individuals about the ways in which their data may be used. In particular, The Trust aims to be open and transparent in the way it uses personal data and, where relevant, to give individuals a choice over what data is held and how it is used.

The GDPR creates new rights for how organisations treats individual’s data and these are detailed below

The Trust complies with all relevant DPA legislation and also ensures that the principles of the General Data Protection Regulations are incorporated into the service that we provide.

The right to be informed

The Trust will ensure that all individuals understand why their data is being obtained, how it is being used and how they can access it. We shall provide this information in a manner that is concise, transparent, intelligible and easily accessible. This information is provided for all ways in which you may communicate with us.

The right of access

The Trust will ensure that all individuals understand why their data is being obtained, how it is being used and how they can access it. We shall provide this information in a manner that is concise, transparent, intelligible and easily accessible. This information is provided for all ways in which you may communicate with us.

The right to erasure

The Trust wants you to be comfortable about the data that we hold about you and we provide the facility for you to request the deletion or removal of your personal data where there is no compelling reason for its continued processing.

You have a right to have your personal data erased and to prevent processing in the following circumstances;

  • where the personal data is no longer necessary in relation to the purpose for which it was originally collected/ processed
  • when the individual withdraws consent
  • when the individual objects to the processing and there is no overriding legitimate interest of for continuing to process it
  • When the personal data was unlawfully processed and the data has to be erased in order to comply with a legal obligation

The Trust can refuse to comply with a request for erasure where the personal data is processed for the following reasons;

  • to exercise the right of freedom of expression and information
  • to comply with a legal obligation for the performance of a public interest task or exercise of official authority
  • for public health purposes in the public interest, archiving purposes in the public interest, scientific research historical research or statistical purposes; or the exercise or defence of legal claims.

The right to restrict processing

If you wish for us to no longer process your data, then we will ensure this happens. You may wish to do this if

  • You contest the accuracy of the personal data,
  • Where you object to the processing of the data
  • When processing is unlawful and you oppose erasure and request restriction instead.
  • If the Trust no longer needs the personal data but you require the data to establish, exercise or defend a legal claim.

If the Trust has disclosed the personal data in question to third parties, we shall inform them about the restriction on the processing of the personal data, unless it is impossible or involves disproportionate effort to do so.

The Trust will inform individuals if it decides to lift a restriction on processing.

The right to data portability

Should you wish for your data to be provided to you in a machine readable format (e.g. CSV) so that another organisation can process this data, then the Trust will facilitate this where possible. Please contact the DPO for more information.

The right to object

You have the right to choose how we use your data, if you object, then please let us know.

The rights in relation to automated decision making and profiling

The Trust does not used automated decision making in any of its processes. People using the portal will be provided with logic driven advice on options but this does not constitute automated decision making.

Direct Marketing

The Trust only uses personal data for direct marketing in the following instances;

  • Stakeholder contact details for email marketing to promote our commercial Training and Consultancy services
  • Contact details for advisers for email marketing to promote our (free) Wiseradviser courses

Permission will be obtained when the contact details are provided together with details of how an individual’s details will be processed.

The Trust must stop processing personal data for direct marketing purposes as soon as it receives an objection from an individual. There are no exemptions or grounds to refuse. The request must be dealt with immediately and be free of charge

How to contact us

The Data Protection Officer for the Trust is the Head of Compliance and Risk. You can contact them by emailing DPO@moneyadvicetrust.org or by writing to Money Advice Trust, Tricorn House, 51-53 Hagley Road, Edgbaston, Birmingham B16 8TP.

Money Advice Trust is a company limited by guarantee registered in England and Wales (company number 4741583) and a registered charity (charity number 1099506).