Quality Assurance Scheme (QAS) Privacy Notice

QAS Privacy Notice – for personal information relating to the personnel of QAS applicant organisations and accredited QAS organisations provided to the Institute and Faculty of Actuaries by the organisation

This notice is designed to be read by both your organisation and those of its personnel whose personal information/personal data is included in the QAS Personal Information provided to the IFoA by your organisation.  We also refer to such individual personnel as "you" / "your" and as "data subject" in this notice.

Background

We, the Institute and Faculty of Actuaries (IFoA), operate a Quality Assurance Scheme (“QAS”) for organisations.  In reviewing applications from organisations wishing to join the QAS, in administering and monitoring an organisation's accreditation, and in monitoring an organisation's participation in the QAS CPD Scheme (if applicable) the IFoA will need to be provided with and process personal information relating to certain of the organisation's personnel (QAS Personal Information). The QAS Personal Information will be provided to us by the organisation concerned.  We will be acting as a data controller for such purposes. For enquiries about this notice or your information rights: our Data Protection Officer can be contacted by:

Telephone: +44 (0) 131 240 1311

Email: data.protection@actuaries.org.uk

This notice and our online Privacy Policy

How the IFoA collects and processes personal information generally (including any QAS Personal Information) is set out in detail in the IFoA's Privacy Policy.

In this QAS Privacy Notice we highlight how we collect and process the QAS Personal Information.  We need to do this in order to:

• assess an organisation’s application to join the QAS as set out in the QAS Application Form, (Upon an organisation successfully achieving QAS accreditation), process information about that organisation and its personnel as required to administer and monitor the organisation’s QAS accreditation. 
• assist with our own internal business process improvement and assessment of the operation of the QAS as a whole.
• acess and monitor an organisation's participation in the QAS CPD Scheme.  

What personal information do we use to (i) process an organisation’s QAS application and (ii) to administer and monitor an organisation’s QAS accreditation and participation in the QAS CPD Scheme (if applicable)?

In respect of (i), we process the personal information that you provide to us about the personnel in your organisation. This includes name, job title, business telephone and email and business address of key contacts within the organisation and name, job title, membership status of the IFoA/other professional bodies, employment history, other relevant employment information and year of qualification of Senior Quality Assurance Representatives (“SQAR”) proposed to represent the organisation.

In respect of (ii), we process the personal information that you provide to us about the personnel in your organisation.  This includes name, job title, business telephone and email and business address of key contacts within the organisation and name, job title, membership status of the IFoA/other professional bodies, employment history, other relevant employment information and year of qualification of the organisation’s SQARs.

By submitting the application form to participate in, and by participating in, the QAS and if applicable the QAS CPD Scheme, you confirm that you are entitled to provide that personal information to us.

What do we do with the personal information that we collect in relation to (i) an organisation’s QAS application and (ii) to administer and monitor an organisation’s QAS accreditation and participation in the QAS CPD Scheme (if applicable)?

In respect of (i), we use the personal information to consider the organisation’s application and for our legitimate interests in assessing whether the organisation is an appropriate organisation to participate in the QAS. 

In respect of (ii), if the organisation is successful in achieving QAS accreditation and if applicable, participating in the QAS CPD Scheme, we will, from time to time, use the personal information for our legitimate interests in order to administer and monitor that organisation’s continued compliance with the requirements of the QAS and the QAS CPD Scheme.  

In respect of both (i) and (ii), we may also process information about the organisation to assist with our own internal business process improvement and assessment of the operation of the QAS and QAS CPD Scheme as a whole.

What is our lawful basis for processing personal information in respect of (i) and (ii)?

The IFoA will only process personal information where there is a lawful basis for doing so.  The lawful basis for processing personal information for the purposes of both (i) and (ii) is its legitimate interests in establishing and operating a QAS scheme and QAS CPD Scheme.  

Sharing of personal information with other parties

We share this personal information with the QAS Sub-Committee, which comprises of members of the IFoA and individuals appointed by the IFoA to serve on this Committee and with the Institute of Chartered Accountants in England and Wales (“ICAEW”) or such other third party assessor as may be appointed by the IFoA for the purpose of assessing eligibility for QAS accreditation and administering ongoing accreditation.

How long will we retain this information?

Beyond reviewing personal data provided in the context of an organisation’s application for accreditation and, if accredited, for monitoring an organisation’s ongoing participation in the QAS and if applicable,the QAS CPD Scheme, we do not retain any personal data other than the limited personal information held in relation to the organisation’s key contacts and Senior Quality Assurance Representatives.   In any event we only retain personal data for as long as legally required or as long as required by the objects in our Royal Charter or as long as necessary for the purposes for which they are processed (whichever is the longer period).

Transfers outside the EEA

As the QAS is an international accreditation scheme, there may be cross-border transfers of data.  We will ensure that any such transfers are subject to appropriate technical, contractual and organisational controls.

How we keep your personal information secure

For information on the security measures applied to the processing of personal information associated with an organisation’s QAS application, QAS accreditation and participation in the QAS CPD Scheme, the IFoA shall ensure that it complies with the security measures set out in its main Privacy Notice.

Your rights as a data subject

You have the right in accordance with and subject to the applicable data protection law to:

• obtain a copy of any personal data we hold that is about you and not subject to any exemption in data protection law;
• correct any information we hold about you that is inaccurate or out of date;
• ensure we dispose of any personal data we hold about you (once all legal and regulatory record keeping requirements have expired);
• restrict the processing your personal data;
• object to us processing your personal data;
• erase your personal data, where we no longer have a lawful basis or valid operational reason for holding it;
• request we send all or some of the personal data we hold about you to another organisation.

For more information please see our Data Subject Rights Policy

If you wish to exercise any of your rights please contact the Data Protection Officer with your request: data.protection@actuaries.org.uk

If you are unhappy with how we have used your personal data

In the first instance, please contact our Data Protection Officer so that we can deal with your enquiry.  If you are unhappy with how we deal with your concerns you have the right to make a complaint to a Supervisory Authority about how we process your personal data.

In the United Kingdom the Supervisory Authority is the Information Commissioner’s Office.