IPS Financial Advice Limited t/a Mortgage123 needs to gather and use certain information about individuals in order to provide services to them. These can include customer names, date of birth, addresses, telephone numbers, copies of identification documents, financial information and medical information. This policy describes how this personal data must be collected, handled and stored to meet the company’s data protection standards — and to comply with the law. IPS Financial Advice Limited t/a Mortgage123 endeavours to provide best practice in data storage and handling in line with EU General Data Protection Regulation (EU) 2016/679 (‘GDPR’) and ePrivacy Regulations 2011.
This policy applies to:
- The head office of IPS Financial Advice Limited t/a Mortgage123
- All branches of IPS Financial Advice Limited t/a Mortgage123
- All staff and volunteers of IPS Financial Advice Limited t/a Mortgage123
- All contractors, suppliers and other people working on behalf of IPS Financial Advice Limited t/a Mortgage123
It applies to all data that the company holds relating to identifiable individuals. This can include:
- Names of individuals
- Date of Birth
- Postal addresses
- Email addresses
- Telephone numbers
- Any other information relating to individuals
What is the policy intended to achieve?
The objectives may include the following:
- To ensure that IPS Financial Advice Limited t/a Mortgage123 complies with GDPR.
- To ensure compliance with the principles of data protection as set down by the Data Protection Commissioner.
- To ensure that the data protection rights of customers are safeguarded.
The policy sets down the arrangements in place to ensure that all personal data records held by IPS Financial Advice Limited t/a Mortgage123 are obtained, processed, used and retained in accordance with the following six principles of data protection:
- Process data lawfully, fairly and Transparently
- Keep for one specified, explicit and legitimate purposes
- Keep it safe and secure
- Keep it accurate, complete and up-to-date
- Ensure that it is adequate, relevant and limited to what is necessary
- Keep in a form that the data subject can be identified only as long as necessary
Everyone who works for or with IPS Financial Advice Limited t/a Mortgage123 has some responsibility for ensuring data is collected, stored and handled appropriately. However, these people have key areas of responsibility:
- The Board of Directors
The board of directors is ultimately responsible for ensuring that IPS Financial Advice Limited t/a Mortgage123 meets its legal obligations.
- The Compliance and Data Protection Officer
- Keeping the board updated about data protection responsibilities, risks and issue
- Reviewing all data protection procedures and related policies, in line with an agreed schedule.
- Arranging data protection training and advice for the people covered by this policy.
- Handling data protection questions from staff and anyone else covered by this policy.
- Dealing with requests from individuals to see the data IPS Financial Advice Limited t/a Mortgage123 holds about them. Checking and approving any contracts or agreements with third parties that may handle the company’s sensitive dat
- The Marketing Manager
- Approving any data protection statements attached to communications such as emails and letters.
- Addressing any data protection queries from journalists or media outlets like newspapers.
- Where necessary, working with other staff to ensure marketing initiatives abide by data protection principles.
General Staff Guidelines
- The only people able to access data covered by this policy should be those who need it for their work.
- Data should not be shared informally. When access to confidential information is required, employees can request it from their line managers.
- IPS Financial Advice Limited t/a Mortgage123 will provide training to all employees to help them understand their responsibilities when handling data.
- Employees should keep all data secure, by taking sensible precautions and following the guidelines below.
- In particular, strong passwords must be used and they should never be shared.
- Personal data should not be disclosed to unauthorised people, either within the company or externally.
- Data should be regularly reviewed and updated if it is found to be out of date. If no longer required, it should be deleted and disposed of.
- Employees should request help from their line manager or the data protection officer if they are unsure about any aspect of data protection.
- Data stored on paper:
- It should be kept in a secure place where unauthorised people cannot see it.
- When not required, the paper or files should be kept in a locked drawer or filing cabinet.
- Employees should make sure paper and printouts are not left where unauthorised people could see them, like on a printer.
- Data printouts should be shredded and disposed of securely when no longer required.
- Data stored on electronic devices:
- It must be protected from unauthorised access, accidental deletion and malicious hacking attempts.
- Data should only be stored on designated drives and servers, and should only be uploaded to an approved cloud computing services.
- Data should never be saved directly to laptops or other mobile devices like tablets or smart phones.
- All servers and computers containing data should be protected by approved security software and a firewall.
- Data stored on Approved Broker CRM Cloud Service, Money Advice+CRM:
For the purposes of compliance, security and excellent customer service, IPS Financial Advice Limited t/a Mortgage123 is subscribed to a third-party CRM software service provider. This means that customer data is stored and accessed by authorized staff by means of secure internet connection.
The CRM system utilizes some of the most advanced technology for Internet security available today. The site uses industry standard Secure Socket Layer (SSL) technology, so the information is protected using both server authentication and data encryption, ensuring that the data is safe, secure, and available only to registered Users in IPS Financial Advice Limited t/a Mortgage123. Each user is provided with a unique user name and password, PIN that must be entered each time they logs on. In addition, The CRM system is hosted in a secure server environment that uses a firewall and other advanced technology to prevent interference or access from outside intruders.
The Money Advice+CRM application and database are hosted on servers in a data centre operated by Dimension Data (previously known as Op Source (www.dimensiondata.com) in the UK. Dimension Data are a SAS 70 certified company.
For more information on MoneyAdvice+CRM, please see the following pages:
Personal data is handled by IPS Financial Advice Limited t/a Mortgage123 only for the purposes of providing financial advice to its customers. However, it is when personal data is accessed and used that it can be at the greatest risk of loss, corruption or theft. The following measures are taken to avoid such risks:
- When working with personal data, employees should ensure the screens of their computers are always locked when left unattended.
- Personal data should never be transferred outside of the European Economic Area.
- Employees should not save copies of personal data to their own computers. Always access and update the central copy of any data.
The law requires IPS Financial Advice Limited t/a Mortgage123 to take reasonable steps to ensure data is kept accurate and up to date. The more important it is that the personal data is accurate, the greater the effort should be put into ensuring its accuracy. It is the responsibility of all employees who work with data to take reasonable steps to ensure it is kept as accurate and up to date as possible:
- Data will be held in as few places as necessary. Staff should not create any unnecessary additional data sets.
- Staff should take every opportunity to ensure data is updated. For instance, by confirming a customer’s details when they call.
- Data should be updated as inaccuracies are discovered.
Profiling – Automatic Decision Making
Financial and mortgage advisors use profiling in their business. The main categories are:
- a) Risk profiling.
Risk Profiling To establish a customer’s attitude to investment risk (relates to pensions and investments) advisors have automated calculators which calculate the customers attitude to various levels of risk having answered a series of questions.
- b) Profiling for marketing purposes.
When we seek to contact you about other services, as outlined above, we run automated queries on our computerised data base to establish the suitability of proposed products or services to your needs.
- c) Establishing affordability and providing quotations for financial services and mortgage product.
Our Regulator, The Central Bank of Ireland, requires that we establish a customer’s ability to afford the cost of a financial or mortgage product before proceeding with a transaction. We have automated processes which assist us profile and calculate a customer’s net disposable income from the information that customers provide to us in relation to their gross income, family expenses, taxation and commitments, etc.
Disclosing Data for Other Reasons
In certain circumstances, personal data may need to be disclosed to law enforcement agencies without the consent of the data subject. Under these circumstances, IPS Financial Advice Limited t/a Mortgage123 will disclose requested data. However, the data controller will ensure the request is legitimate, seeking assistance from the board and from the company’s legal advisers where necessary.
Sharing Information with Third Parties
In certain instances, we may make your information available to third parties with whom we have a relationship where that third party is providing services on our behalf to clients. You can view the list of product providers we hold agencies with via the Central Banks website. We will only provide those third parties with information that is necessary for them to perform the services and we take measures to protect your information.
Subjects Access Requests
All individuals who are the subject of personal data held by IPS Financial Advice Limited t/a Mortgage123 are entitled to:
- Right of access – you have the right to request a copy of the information that we hold
- Right of rectification – you have a right to correct data that we hold about you that is
inaccurate or incomplete.
- Right to be forgotten – in certain circumstances you can ask for the data we hold about
you to be erased from our records.
- Right to restriction of processing – where certain conditions apply to have a right to
restrict the processing.
- Right of portability – you have the right to have the data we hold about you transferred
to another organisation.
- Right to object – you have the right to object to certain types of processing such as direct
- Right to object to automated processing, including profiling – you also have the right
to be subject to the legal effects of automated processing or profiling.
- Right to judicial review: if IPS Financial Advice Limited t/a Mortgage123 refuses your request under rights of
access, we will provide you with a reason as to why.
Access requests from individuals should be made by email to [email protected] or post addressed to IPS Financial Advice Limited t/a Mortgage123, 64 O’Connell Street, Limerick, Ireland. The requested information will be supplied within a period no longer than 40 days.
In the event that you wish to make a complaint about how your personal data is being processed by IPS Financial Advice Limited t/a Mortgage123 or how your complaint has been handled, you have the right to lodge a complaint directly with the data supervisory authority the Data Protection Commission.