PRIVACY NOTICE FOR CLIENTS AND POTENTIAL CLIENTS

February 2024

NACSA is committed to protecting the individual privacy rights and choices of our clients and visitors.

Our Privacy Notice contains important information about the types of personal information we collect and process; what we do with it; who we may share it with and why; and your rights when it comes to the personal information you provide us with.  We may need to make changes to our Privacy Notice in line with regulatory requirements; so please check our website for updates from time to time. If there are significant changes such as where your personal data will be processed; we will contact you to let you know.  

Who we are

NACSA

193 Wolverhampton Street
Dudley, West Midlands, DY1 1DU

01384 572525

Types of data that we process and our legal basis

Depending on how you choose to interact with us, the personal data about you that we collect and process is shown in the table below.  

By law, we must have a legal basis for processing personal data. We take your privacy seriously and we will only ever collect and use personal data where it is necessary, fair and lawful to do so. Our legal bases are shown on the table and may be different for clients and prospective clients.

Data that we process Inquiries Legal basis for inquiries Consultations Legal basis for consultations Clients Legal basis for clients
Information about you – name, telephone number, email address, name of other parent, name of child and age, other information about your situation that you chose to give us.
✔
We will process this data with your consent, when you contact us.
✔
We will process this data under our contract with you.
✔
We will process this data under our contract with you.
Your contact with us –phone calls, emails or letters.
✔
We will process under our legitimate interest in keeping a record of our correspondence.
✔
We will process under our legitimate interest in keeping a record of our correspondence.
✔
We will process under our legitimate interest in keeping a record of our correspondence.
Your contact with us – audio-visual recordings of meetings, video or phone calls.
×
✔
We will process this data with your consent.
✔
We will process this data with your consent.
Information that is automatically collected via essential cookies when you visit one of our websites (please see our cookie popup for more information)
✔
We use legitimate interest for essential cookies and consent for all non-essential cookies.
✔
We use legitimate interest for essential cookies and consent for all non-essential cookies.
✔
We use legitimate interest for essential cookies and consent for all non-essential cookies.
Marketing and communication preferences – this includes marketing emails, client feedback, responses to surveys and complaints.
✔
We can send you marketing material once you are a client or you have made an inquiry as a prospective client.
✔
We can send you marketing material once you are a client or you have made an inquiry as a prospective client.
✔
We can send you marketing material once you are a client or you have made an inquiry as a prospective client.
Images captured by CCTV when you visit our office.
✔
Legitimate interest
✔
Legitimate interest
✔
Legitimate interest
Further information about you from the CMS portal or from other documents, such as:
- Letters
- Decisions
- Refusals
- Enforcements
- Payment plans
- Account statements
- Income
- Deductions of earnings with employer’s name and address
- Bank account deduction orders
- First name of child and date of birth
- If self-employed, a break down of their income
- Pensions
- Assets
- Case information – name, date of birth, NI number, contact preferences, mobile and landline numbers
- Information on other children, such as full name, date of birth, child reference number and dates moved in or out
X
X
✔
We require this information under our contract to provide you with our services.
Information you may provide to us about other people, such as the other parent or children. For children, we will collect and use only the information required to identify the child (such as their name and date of birth).
✔
We require this information about the other parent under legitimate interest in order to do a conflicts check on their name.
✔
We require this information under our contract to provide you with our services.
✔
We require this information under our contract to provide you with our services.
Information from your CMS portal and other correspondence with CMS.
X
X
✔
We access your portal with your consent. We process the data under our contract to provide you with our services.
Information from the Tribunal regarding your appeal.
X
X
✔
We process the data under our contract to provide you with our services.
Information from your professional advisers, where you have provided authority for them to share information.
X
✔
We process this data with your consent.
✔
We process this data with your consent.

If you do not wish us to collect and use your personal information in these ways, it may mean that we will be unable to provide you with our products or services. We will only use your personal data when the law allows us to.  

Where we rely on consent as a legal basis for processing your personal data, you have the right to withdraw that consent to at any time by contacting us.

Our business requirements – legitimate interests

Action Reason for processing – legitimate interests
Managing global business and marketing strategies (including recording and reporting on our business development activities)
ContentWe need to have business development and marketing strategies
Purchasing, maintaining and claiming against our insurance policies
We need to protect our business.
Continuously reviewing and improving our services and developing new ones
We use your feedback to improve our services.
Obtaining legal advice, establishing, defending and enforcing our legal rights and obligations in connection with, any legal proceedings or prospective proceedings.
We need to understand our obligations and establish and defend our legal rights.
Monitoring and producing statistical information regarding the use of our platforms, and analysing and improving their functionality.
We need to ensure that our website and other platforms are working properly.
Maintaining the security of our systems, platforms, premises and communications, including detecting and preventing threats
We need to ensure that our premises and our platforms are secure.
Managing the proposed sale, restructuring, transfer or merging of any or all part(s) of our business, including to respond to queries from the prospective buyer or merging organisation
We need to be able to manage or sell parts of our business, if we choose to do so.

We have a legitimate interest in using your personal data for the above purposes.  We have balanced your rights and freedoms against our business needs. Please inform us if you object to our processing.

Where we collect your information 

We may collect your personal information directly from you or from others:

  • Requests for our services
  • recorded video or telephone conversations with us
  • emails or letters you send to us
  • meetings with us
  • from the CMS or the Tribunal 
  • from your professional advisers, where you have provided authority for them to share information.
  • Automated decision-making systems

We do not use any automated decision making.

Whom we may share your information with

We may share your information with the third parties in this chart:

Entity Legal basis for sharing
Our professional advisers such as lawyers and accountants
Legitimate interest
Government or regulatory authorities or law enforcement
Legal obligation
Professional indemnity or other relevant insurers
Legitimate interest
HMRC
Legal obligation
Third parties to whom we outsource certain services such as, without limitation, document processing services, confidential waste disposal, IT systems or software providers, IT support service providers, document and information storage providers.
Legitimate interest
Third party service providers to assist us with client insight analytics, such as Google Analytics
Consent

Whenever we share your personal information, we will do so in line with our obligations to keep your information safe and secure.

Please note this list is non-exhaustive and there may be other examples where we need to share with other parties in order to provide our services as effectively as we can.

We conduct an appropriate level of due diligence and put in place contractual documentation in relation to any sub-contractor to ensure that they process personal data appropriately and according to our legal and regulatory obligations.

Where your information is processed 

Your information is processed in the UK.

How we protect your information

We take information and system security very seriously and we strive to comply with our obligations at all times. Any personal data which is collected, recorded, or processed in any way, whether on paper, online or any other media, will have appropriate safeguards applied in line with our data protection responsibilities.

Your data is protected by controls designed to minimise loss or damage through accident, negligence, or deliberate actions. Our employees are trained to protect sensitive or confidential information when storing or transmitting data in any medium including electronically and must undertake annual refresher exercises on this.

How long we keep your information for 

We will keep your personal information where it is necessary to provide you with our services while you are a client.  

After you stop being a client, we will keep your data for six years as we need to retain accurate records of your dealings with us to respond to any complaints, challenges, litigation or queries that you or others may raise in the future. 

We will keep a record of all your invoice and payments for seven years for HMRC requirements.

How to access your information and your other rights

You have the following rights in relation to the personal data we hold about you:

  • Your right of access
    If you ask us, we’ll confirm whether we’re processing your personal data and, if necessary, provide you with a copy of that personal data (along with certain other details). If you require additional copies, we may need to charge a reasonable fee.
  • Your right to rectification
    If the personal data we hold about you is inaccurate or incomplete, you are entitled to request to have it rectified. If you are entitled to rectification and if we’ve shared your personal data with others, we’ll let them know about the rectification where possible. If you ask us, where possible and lawful to do so, we’ll also tell you who we’ve shared your personal data with so that you can contact them directly.
  • Your right to erasure
    You can ask us to delete or remove your personal data in some circumstances such as where we no longer need it or if you withdraw your consent (where applicable). If you are entitled to erasure and if we’ve shared your personal data with others, we’ll let them know about the erasure where possible. If you ask us, where it is possible and lawful for us to do so, we’ll also tell you who we’ve shared your personal data with so that you can contact them directly.
  • Your right to restrict processing
    You can ask us to ‘block’ or suppress the processing of your personal data in certain circumstances, such as where you contest the accuracy of that personal data or you object to us. If you are entitled to restriction and if we’ve shared your personal data with others, we’ll let them know about the restriction where it is possible for us to do so. If you ask us, where it is possible and lawful for us to do so, we’ll also tell you who we’ve shared your personal data with so that you can contact them directly.
  • Your right to data portability
    You have the right, in certain circumstances, to obtain personal data you’ve provided us with (in a structured, commonly used and machine readable format) and to reuse it elsewhere or to ask us to transfer this to a third party of your choice.
  • Your right to object
    You can ask us to stop processing your personal data, and we will do so, if we are:
    • relying on our own or someone else’s legitimate interests to process your personal data, except if we can demonstrate compelling legal grounds for the processing; or
    • processing your personal data for direct marketing purposes.
  • Your right to withdraw consent
    If we rely on your consent (or explicit consent) as our legal basis for processing your personal data, you have the right to withdraw that consent at any time.
  • Your right to lodge a complaint with the Information Commissioner’s Office
    If you have a concern about any aspect of our privacy practices, including the way we’ve handled your personal data, you can report it to the ICO. We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance.

Please note that some of these rights may be limited where we have an overriding interest or legal obligation to continue to process the data or where data may be exempt from disclosure due.

The ICO can be contacted at:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113
Fax: 01625 524510