Callback External

Us and our contact details.

Parliament Hill Limited act as data controller and our contact details are Parliament Hill Ltd, 40 Gracechurch Street, London, England, EC3V 0BT. Contact e-mail address for Data Protection requests is andrew@parliament-hill.co.uk.

Main purpose and lawful basis for processing.

The information we will hold about you will be the information you have given us a ‘request for a provider to call you back / e-mail you back / contact you’ combined with any other information we already hold about you (your ‘call back request’ could relate to something we have already been contacted on) or if your ‘call back request’ is for a Provider to call you back, then information they may supply to us.

Our main business is the provision, management, and running of benefit schemes and we do so to our Clients. Within the Benefit Scheme there is a definition of ‘members’ who have access to the scheme. We provide services to those members under the scheme. Where we provide you with a service under or in connection with the Benefit Scheme, then that service ‘‘call back request’’ creates a contract between you and us in respect of that service for which we receive consideration under the main Benefit Scheme arrangement.

Where your request does not relate to the Benefit Scheme we will be processing your data and request based on what you have provided to us in the ‘‘call back request’’ form and this Privacy statement. We will treat your ‘‘call back request’’ as you giving us your consent in respect of all matters raised in that ‘call back request’ form, plus other items covered in this privacy statement.

We will we processing your personal data to give you response to your ‘‘call back request’’ or acting on any ‘‘call back request’’ or requests that you raise in your ‘‘call back request’’. We will be processing this data at your request and will treat that request as you giving us any and all consent required in this privacy statement.

Call back requests for a provider to call you back will be passed straight through to the Benefit Provider.

We provide benefit schemes on behalf of clients and if you have access to one of our benefit schemes, then you do so at the Clients request. We have a contractual duty to update and keep our Client advised of significant ‘call back request’ comments that may reflect on the performance of the benefit scheme.

Legitimate business interests and legal requirements and those possible recipients or personal data.

Below is an example of our and others legitimate business interests and should not be considered an exclusive list.

Where we are regulated or the benefit is regulated we may need to comply with regulatory requirements then we might need to provide data to the Financial Ombudsman Service, the Financial Conduct Authority, Financial Services Compensation Scheme of the Information Commissioners office.

In administering your ‘call back request’, we would also be handling some of that data for our legitimate business interests. That could include, but is not limited to, the maintenance of legal records, task management, staff training and monitoring, record keeping and reporting back to our client under the benefit scheme or seeking advice from others. We may use suppliers who provide basic services to us as a commercial business and in providing their services they may have access to certain data either held by us, which they require in providing their service to us or that might pass through them.

We run the Benefit Scheme for our Client and receive a consideration for doing so. That Benefit Scheme is open to those who are defined as ‘members’ under the Benefit Scheme. Our Client has a legitimate business interest in checking, auditing or receiving reports from us on the performance of the Benefit Scheme. We may give ‘call back request’ to our client under the benefit scheme.

We and the benefit provider would have a legitimate business interest in exchanging comments that may reflect on the performance of the benefit. This is for the purpose of continually improving the service.

Where consent may be involved and where consent is given or obtained.

We do not place a restriction on the category of personal data you wish to provide us with, but we would generally not expect you to provide us with ‘special category or sensitive’ data. If you do, then by providing us that data, we would treat that as you having given us consent to hold and process such data about you in respect of your ‘call back request’ or provided in any other communications.

Automated decision making and sending data outside of the EEA.

We do not pass your data outside of the European Economic Area unless we feel there is a need to do so and that would have been reasonably foreseeable based on the content of your ‘call back request’. We will take your ‘call back request’ to have given consent to such action. We will treat something as being foreseeable if it related to a Benefit provided in part or in whole outside the EEA or if you are contacting us from outside the EEA or ask us to use an outside the EEA contact point or if a matter external to the EEA was raised in the ‘call back request’. Otherwise, if we need to send data outside the European Economic Area we will contact you again for your specific consent for us to do so.

We do not use any automated decision-making systems. Log in systems, if managed by us, may include an automated check of log in details.

The period we may store your data or the criteria we may use for storage.

Storage period will depend on the nature of the ‘call back request’. For some ‘call back request’ that is connected to a regulatory activity, benefit or product or service your data could be stored by us for up to a period of six and a half years or such other times as may be required by law, of regulatory rules. If the service is connected to the Benefit Scheme then we may need to store the data for the period the scheme is running plus a further six years. ‘call back request’ that has no regulatory connection will be stored for the time we need to take to respond to that ‘call back request’ plus a further twelve months period or such other times as may be required by law or by our own business interests. Data stored and processed by other data controllers will be stored and processed at their discretion.

Below are your rights in respect of this data.

General rights. Where the law does allow us to charge a fee then we reserve the right to do so.

You have the right to request why we are holding your data, the categories of data we hold, the purpose of the processing, the categories of the recipients of such data, how long we may hold that data, if automated processing is involved, and the possible source of the data if we did not collect the data direct from you.
You can ask if any of your personal data is transferred outside of the EEA by us or a processor acting for us.
You can ask for copies of personal data undergoing processing, where that does not affect the rights and freedoms of others. If you require further copies we can charge you a reasonable fee.
You can ask us to rectify inaccurate information or change and update any data that we hold about you.
You have the right to lodge a complaint regarding our processing of your personal data. You can complain to us at our contact address above. You can lodge a complaint with the Information Commissioners Office (ICO) if you feel that we are infringing GDPR rules when handling your personal data. You can find out details about how to raise issues with the ICO from their web site www.ico.org.uk or via their help line 0303 123 1113.
You have the right to the rectification of any inaccurate personal data we hold about you or to have’ incomplete data’ made ‘complete’ provided the processing requires such completeness.
In certain cases, listed below you have the right to request the erasure of personal data we hold about you, but such a request would not override our compliance with any legal obligation we have;

it is no longer necessary for us to hold such personal data in relation to the purpose for which it was collected,
you gave consent and now wish to withdraw that consent and there is no legal grounds for us to continue processing,
on the grounds that we do not have a legitimate interest in processing your personal data and that was the legal basis we were using, and can verify that is the case,
where we are using your personal data for marketing purposes,
the personal data was unlawfully processed, but you can ask us to continue storage of such data if you wish rather than select erasure.

You have the right to restrict processing, but not continued storage, where the accuracy of the data is contested whilst we verify the accuracy.
There may be cases where you can request that we transfer some personal data to another controller.
You have the right to object to a decision based solely on automated decision making or profiling where this is not necessary for entering into or the performance of a contract between us and you or you have already given us your explicit consent and the process has already taken place, but we will where reasonable and appropriate, review any decision made and consider any point of view you make regarding that decision.
Were we have given the legal reason for processing as your having given us ‘consent’ to that processing, then you can withdraw that consent and after that withdrawal no further processing will take place, but this does not affect processing which is based on other legal grounds. Please note that making such a request may result in us being unable to respond to your ‘call back request’ or any request made in your ‘call back request’. We may still be obliged to store a record of the ‘call back request’ and our actions to your request to cancel consent.