Member privacy notice

Version number: ME2.5

ICAEW is the controller for the Personal Data collected from ICAEW Members unless this is stated otherwise. ICAEW is registered with the Information Commissioner’s Office (ICO) with registration number (Z5765897). In this privacy notice, references to ‘we’, ‘us’ or ‘our’ mean ICAEW. You can contact ICAEW in a number of ways as follows:

• Email: dataprotection@icaew.com
• Post: The Data Protection Office, ICAEW, Metropolitan House, 321 Avebury Boulevard, Milton Keynes, MK9 2FZ UK
• Telephone: +44 (0)1908 248 250

Personal Data is any information which directly or indirectly identifies an individual, for example, your name, address, membership and/or member number, NI number, qualifications, date of birth, photos, videos or voice recordings.

Special categories of Personal Data are a set of Personal Data that we are required to look after even more carefully. Subject to the relevant data protection law, special categories of Personal Data include details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, and genetic and biometric data. In limited circumstances, we collect special categories of Personal Data about you through the application process, for example, we may collect details of your health data to ensure that we can make reasonable adjustments for you.

There are also strict rules which govern when we can collect and use information about criminal convictions and offences.  We may need to collect and use this type of information about you for legal or regulatory purposes, for example where we are required to assess fitness for admission into membership.

We collect Personal Data about you when you give us Personal Data in direct interactions with us during your time as an ICAEW member, for example by completing the registration process, attending courses and webinars, or through correspondence in supporting you and resolving any enquiries. This includes:

Identity Data	Name, date of birth
Contact Data	Your address(es), email address(es), social media and phone number(s).
Diversity and Inclusion Data	Details of your gender, sexual orientation, nationality, ethnicity and disability information.
Education Data	Details of academic and professional qualifications including, educational establishments, dates of study, subjects studied and results.
Career Data	Employment history, including start and end dates with previous employers, information about your current level of remuneration, including benefit entitlements. Details of membership of Professional Bodies.
Marketing and Communication Preferences	Details of your preferences for marketing and communication from ICAEW and any third parties
Member Data	Your member number
Criminal Offence Data	Information about your criminal record, if applicable.
Financial Data	Details of your bank account and credit card details. including previous payments, and payment methods used.
Audio Data	Voice recordings of our telephone calls with you.
Enquiry Data	Any personal data provided by yourself to us via correspondence through webchat, emails, webforms, applications or letter. Copies of correspondence we sent to you to advise or support on billing or regulatory matters, significant to your membership.
Website Data	Information collected during your use of our website. Please see our website privacy notice (https://www.icaew.com/icaew-policies/privacy-notice) for more details.
Complaint Data	Information received regarding complaints with regards to conduct and practice as a Chartered Accountant.

Some of the Personal Data we process is mandatory, meaning that if you do not provide it to us, we will be unable to provide some or all member services to you.  We will let you know when this is the case.

Processing Personal Data from members allows us to administer and manage the process of registering as a member, studying and taking exams with us. In order to comply with Personal Data protection laws, we need a lawful basis (a reason) to process your Personal Data. Subject to the relevant data protection law, we may use the following lawful bases to obtain and use your Personal Data.

1. Performance of a Contract – We need to process your Personal Data to take steps at your request, prior to entering into a contract with you and for the performance of our contract with you as an ICAEW member.
2. Consent – Some Personal Data is processed because you have given your consent. Consent can be withdrawn at any time by either logging into your online member account and amending your preferences or by contacting us at dataprotection@icaew.com.
3. Legal or Regulatory Obligation – In some cases, we need to process Personal Data to comply with a legal or regulatory obligation which we are subject to.
4. Public Interest – Where processing the personal data is necessary for the performance of a task carried out in the public interest or in the exercise of official authority.
5. Legitimate Interest – Where processing the Personal Data is in our legitimate interests (or those of a third party) provided that your fundamental rights do not override such interests. We make sure we consider and balance any potential impact on you (both positive and negative) and your rights before we process Personal Data for our legitimate interests.

The table below describes the ways in which we use your Personal Data and the legal bases we rely on to do so, subject to the relevant data protection law. Where appropriate we have also set out our legitimate interests in processing your Personal Data.

Purpose and/or activity	Type of Data	Legal basis for processing
To register you as a member, provide you with advice in relation to your registration as a member, to enable you to sign up for and use a member account on our platforms, provide services, to administer and manage your member journey	Identity Data Contact Data Career Data Education Data Financial Data Criminal Offence Data Member Data Diversity and Inclusion Data	Performance of a contract: to enable you to register as a member and to communicate with you once you become a member.
To take payment or provide you with a refund, including the collection of renewals or outstanding debt	Identity Data Contact Data Financial Data	Performance of a Contract: to allow us to take, if necessary refund, payments made by you or on your behalf, for the provision of services by ICAEW to you as a member.
To administer your ICAEW Library access to resources	Identity Data Contact Data	Performance of a contract: to register you as a user of the ICAEW Library and enable you to use our library services
To respond to and deal with with enquiries, internal investigations, disputes, appeals, complaints or other similar or related matters	Identity Data Contact Data Career Data Education Data Financial Data Criminal Offence Data Member Data Diversity and Inclusion Data (Dependant on complaint type/context) Complaint Data Audio Data Enquiry & Web Chat Data Health related information (when volunteered and related to the enquiry)	Legitimate Interests: in our legitimate interests to investigate, deal with disputes and respond to enquiries, appeals, complaints or other similar related matters.
Facilitating the sharing of your contact details on support pages online if you have opted in to ICAEW through various networks such as boards, committees, as a local Contact Member or Support Member	Identity Data Contact Data	Consent: Where you have provided your consent through the various networks, opted in as a Local Member or Support Member
To provide you with updates and information, including changes to regulations or changes to the way rules are applied and other updates relevant to you. We will only send direct marketing emails and our member magazine/newsletter to you with your consent. Please see the Direct Marketing section in this table below for more information	Identity Data Contact Data Marketing and Communication Preferences	Performance of a contract: to deliver to you the services included in your membership.
For non-UK residents and members of other professional bodies becoming an ICAEW member; to manage and administer routes to becoming an ICAEW member; to assess ability of prospective referee to act as a referee for prospective member; and to assess eligibility	Identity Data Contact Data Career Data Education Data Financial Data Criminal Offence Data Member Data Diversity and Inclusion Data	Performance of a contract: to enable you to register as a member and to communicate with you once you become a member.
Direct Marketing, communicating with you to promote our/relevant third party services and sending you our member magazine by post or newsletters via email.	Identity Data Contact Data Cookie Data Marketing and Communication Preferences	Consent: where you have consented to receiving the communications.   Legitimate Interests: in our legitimate interests as a professional body and regulator of chartered accountants, we will use your Personal Data for marketing purposes where we have a relevant or appropriate relationship with you or where there is a reasonable expectation of us doing so.
Serving you with targeted and retargeted advertisements and monitoring the success of those advertisements.	Identity Data Contact Data Cookie Data	Legitimate Interests: in our legitimate interests as a professional body and regulator of chartered accountants, we will use your Personal Data for marketing purposes where we have a relevant or appropriate relationship with you or where there is a reasonable expectation of us doing so and also to monitor the success of these advertisements in order to understand how better to serve ads to you.
To provide you with member benefits	Identity Data Contact Data Career Data	Consent: where you have opted in to receive promotional emails from third parties
To confirm eligibility for the services provided by caba	Identity Data Contact Data Member Data	Performance of a contract: to deliver to you the services included in your membership.
To administer, process and review CPD Training including declarations and confirmation with employers if required	Identity Data Education Data	Performance of a contract: to ensure fitness for membership and continue to be able to deliver to you the services included in your membership.
Maintaining the member public directory, Find a Chartered Accountant	Identity Data Contact Data Career Data	Public Interest: Maintaining a public directory of certified accountants is a task carried out in the public interest and a requirement as part of the official authority vested in ICAEW.
Conducting research	Identity Data Contact Data Career Data Education Data Diversity and Inclusion Data	Consent: Where you have consented to take part in our wider research activities. Legitimate Interests: in our legitimate interests to understand more about our Members, their views, and how better to serve our Members.
In fulfilling ICAEW’s obligation as a Regulatory Body	Identity Data Contact Data Career Data Education Data Criminal Offence Data Financial Data Complaint Data	Necessary for performance of a task in the public interest: To protect the public from dishonesty
Voting for example in ICAEW Council elections, AGM	Identity Data Contact Data	Performance of a contract: to deliver to you the services included in your membership.
Audit related activities to ensure ICAEW understands it business practices	A sample of all Personal Data	Legitimate Interests: where we have a legitimate interest in auditing our internal processes and procedures to ensure that we are complying with applicable laws and internal and  managing risk appropriately.
Anonymisation of personal data for the onward activities of Management Information and Business Intelligence	All Personal Data	Legitimate Interest of the ICAEW for business improvement and intelligence purposes.
To run reports and analysis on Member data	All Personal Data Education Data Career Data Diversity and Inclusion Data Financial Data	Legitimate interest: in our legitimate interest to understand the intake and trends of ICAEW Members
To administer and facilitate reciprocal membership with approved bodies	Identity Data Contact Data Education Data Diversity and Inclusion Data	Consent: Where you have consented to ICAEW sharing your personal data with approved bodies to facilitate your reciprocal membership
Performing system testing in order to enhance and improve our products and services	Identity Data Contact Data Education Data, Career Data	Legitimate interest: In our legitimate interest to review and improve our services provided to you

Where the information we process is special category or sensitive data such as your health data, subject to the relevant data protection law, the additional bases for processing that we rely on may include:

1. Where you have provided ICAEW with your explicit consent to the processing
2. Where processing is necessary for the establishment, exercise or defence of legal claims
3. Where processing is necessary for reasons of substantial public interest

We keep Personal Data that we obtain about you during your time as an ICAEW member for no longer than is necessary for the purposes for which it is processed, except as otherwise required or permitted by law. How long we keep your Personal Data will depend on how long you remain a member, the nature of the Personal Data concerned and the purposes for which it is processed.

No automated decision making is used in relation to members.

ICAEW may share your Personal Data with third-parties where we have a legal obligation, contract or other legitimate interest to do so, subject to the relevant data protection law. These services include, but are not limited to:

1. Payment providers;
2. Business system providers;
3. Website content and hosting providers, including analytics;
4. Building landlords and facilities management organisations (CCTV and access control systems);
5. We may share your Personal Data with member societies for event purposes or to allow such societies to communicate with you, where you have provided consent;
6. Criminal convictions: If you disclose a criminal conviction, this will be shared with ICAEW's internal professional conduct team and depending on the circumstances may also be shared with third parties such as regulators or other professional bodies;
7. Chartered Accountants Benevolent Association (caba) in order for caba to be able to provide services to you;
8. Regulators and other professional bodies as we are obligated to do so as a Regulatory Function for example, where a member moves jurisdiction and we are required to advise whether said member is fit and proper;
9. Third party content sponsors, in order to assist them in delivering an event that you have registered to attend or where they are providing content so that they can send you relevant information that may be of interest to you. If you have signed up using a personal email address, your information will only be shared with third party content sponsors for marketing purposes if you have provided your consent. All members can opt-out of their data being shared for marketing purposes at any time;
10. Third parties who may provide member benefits to you;
11. Credit reference agencies;
12. Your Employer –
    1. If you have an ICAEW Audit Qualification, to ensure that your employer is aware of your qualification. This helps employers to identify individuals who can act as approvers of students’ audit experience in order for them to apply for the ICAEW Audit Qualification;
    2. If your employer pays for your membership fees, to ensure that these are invoiced correctly;
    3. Where member personal data is shared to comply with Continuous Professional Development (CPD) regulations; and
13. We also occasionally work with external organisations to carry out market research about ICAEW or for topics of public interest. We may share your email address with these organisations so that they can contact you directly and carry out this research independently from ICAEW. We only use organisations that adhere to the Market Research Society code of practice.

Your Personal Data may be transferred to other third-party organisations in certain scenarios in accordance with law:

1. If we are discussing a merger or acquisition, Personal Data may be transferred to respective third parties under suitable terms as to confidentiality;
2. If we are reorganised or sold, Personal Data may be transferred to a buyer who can continue to provide services to you;
3. If we are required to by law, or under any regulatory code or practice we follow, or if we are asked by any public or regulatory authority, for example the Police, we may need to share your Personal Data; or
4. If we are investigating or defending any legal claims your Personal Data may be transferred as required in connection with defending such investigations and/or claims.

In some cases, we or our suppliers may need to process Personal Data outside your country, the European Economic Area (EEA) and/or United Kingdom (UK). Where this is the case we will only share the minimal amount of Personal Data necessary for the purpose of processing and, where possible, we will share the Personal Data in an anonymised form.

Whenever we transfer your Personal Data out of the UK, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:

1. we will only transfer your Personal Data to countries that have been deemed to provide an adequate level of protection for Personal Data by the UK;
2. where we use certain processors, we may use specific contracts approved by the UK which give Personal Data the same protection it has within the UK. When we rely on this measure we will ensure that the third-party can comply with the provision of such contracts and we have confirmed that the country to which the Personal Data is transferred has adequate data protection laws in place to protect Personal Data.

Please contact us at dataprotection@icaew.com if you would like further information about the specific mechanism used by us when transferring your Personal Data.

We have appropriate security measures in place to prevent Personal Data from being accidentally lost, or used or accessed in an unauthorised way. We limit access to your Personal Data to those who have a genuine business need to know it. Those processing your Personal Data will do so only in an authorised manner and are subject to a duty of confidentiality.

We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so.

Under the relevant data protection law, you may have rights including:

1. Your right of access – You have the right to request access to, or ask us for copies of, your Personal Data.
2. Your right to rectification – You have the right to ask us to rectify Personal Data you think is inaccurate. You also have the right to ask us to complete Personal Data you think is incomplete.
3. Your right to erasure – You have the right to ask us to erase your Personal Data in certain circumstances.
4. Your right to restriction of processing – You have the right to ask us to restrict the processing of your Personal Data in certain circumstances.
5. Your right to object to processing – You have the right to object to the processing of your Personal Data in certain circumstances.
6. Your right to data portability – You have the right to ask that we transfer the Personal Data you gave us to another organisation, or to you, in certain circumstances.
7. Rights related to automated decision making, including profiling -You have the right to ask for explanations on a decision based on automated processing that may significantly affect you, and the right not to be subjected to a decision based solely on automated processing (including profiling) which may significantly affect you. We do not make any employment decisions, solely using automated decision making technologies.

In most cases we will deal with your request as soon as possible and at the latest within one calendar month of the request, subject to the relevant data protection law. If we need to extend the time period for responding to your request, we will let you know within the period. We do not charge a fee for any such requests, unless there are exceptional circumstances.

If you wish to exercise any of your rights, please contact our Data Protection Office via email using dataprotection@icaew.com

If you have any concerns about the Personal Data we use about you, you have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues, by contacting them at www.ico.org.uk, or the relevant data protection authority of your country as mentioned in the applicable Appendix. We would, however, appreciate the chance to deal with your concerns before you approach the ICO or the relevant data protection authority, so please feel free to contact us in the first instance via email using dataprotection@icaew.com.

This Appendix applies to individuals who reside in the People's Republic of China (for the purposes of this privacy notice, excluding Hong Kong Special Administrative Region, Macau Special Administrative Region and Taiwan) (China).

This Appendix supplements the main body of this privacy notice should be read together with the main body. In the event of any conflict or inconsistency between this Appendix and the main body of this privacy notice, this Appendix shall prevail.

Legal basis for processing your Personal Data

We process your Personal Data for the purposes mentioned in the main body of this privacy notice with your consent or as otherwise required or permitted by applicable law (e.g. where the processing is necessary for concluding or performing a contract with you, where the processing is necessary to perform legal obligations, etc.).

Processing of your Personal Data upon the expiry of the relevant retention period

We will irreversibly destroy or anonymize your Personal Data upon the expiry of the relevant retention period in a way that prevents that information from being restored or reconstructed.

Sensitive Personal Data

Sensitive Personal Data is Personal Data that, once leaked or illegally used, may easily cause the personal dignity of a natural person to be infringed or his/her personal or property security to be endangered. It includes data related to biometrics, religious belief, specific identity, medical health, financial account and location tracking, the Personal Data of a minor under the age of 14 (Minor Personal Data), as well as government issued ID information. The sensitive Personal Data about you we process may include Diversity and Inclusion Data, Criminal Offence Data, Financial Data and Complaint Data. We only process your sensitive Personal Data where such processing is strictly necessary for the relevant purposes identified in the main body of this privacy notice. Our processing of your sensitive Personal Data will adhere to the safeguards mandated by applicable laws and regulations. However, depending on the specific type of sensitive Personal Data involved, such processing may result in various impacts, including potential harm to your reputation, property, or personal safety in the event of a data breach.

We will not knowingly collect or process Minor Personal Data except with consent of the parent or guardian or as otherwise permitted by law. When we collect or process Minor Personal Data, we will process such data in accordance with the safeguards set out in applicable laws and regulations.

If you are a parent or guardian who believes that we collect or process any Minor Personal Data of your child without your consent or would like to erase, correct, or exercise any other right regarding any Minor Personal Data of your child, or have inquiries or complaints about how we process Minor Personal Data, please contact our Data Protection Office, which is in charge of protection of Minor Personal Data, through the means mentioned in the main body of this privacy notice.

Sharing of your Personal Data

With your express consent where required, we may share your Personal Data with third parties as described in the main body of this privacy notice.

Some of the third parties may process your Personal Data for their own purposes as data controllers, in which case their own privacy policies will apply, including as to the purposes and means of processing and categories of Personal Data processed. The following list specifies the identity of the third-party data controllers that we may share your Personal Data with, basic information about their data processing activities and links to their privacy policies (which you may refer to for more details about how they process your Personal Data and their contact information).

Overseas transfer of your Personal Data

As ICAEW operates globally, with your express consent where required, we may transfer your Personal Data outside of China, including to the UK and other jurisdictions where we, our service providers and other relevant third parties conduct business. In particular, your Personal Data may be transferred to our office in the UK for our storage and processing in accordance with this privacy notice.

We may also share your Personal Data with third parties outside of China. The following list specifies the identity of the third parties outside of China that we may share your Personal Data with, basic information about their data processing activities and links to the relevant privacy policies (which you may refer to for more details about how they process your Personal Data, their contact information, and procedures to exercise data subject rights with them).

Your additional rights

Besides the rights listed in the "Your Rights" section in the main body of the privacy notice, you also have the following rights:

1. Your right to deregister your account – You can request to deregister any account you may have with us. However, if you deregister your account, certain services or processes (including member services) may be disrupted or become unavailable.
2. Your right to withdraw your consent – You can withdraw your consent to our processing of certain Personal Data about you when we rely on your consent for such processing. Please note that your withdrawal may lead to certain consequences (e.g. disruption or unavailability of certain services or processes, including unavailability of member services) if such processing is strictly necessary for a certain purpose and consent is the only legal basis for our processing.

Inquiries or complaints

If you have any requests to exercise rights, inquiries or concerns about the Personal Data we use about you, please contact us at china@icaew.com. You also have the right to make a complaint at any time to the Cybersecurity Administration of China (CAC) or its local counterparts.

This Appendix applies to individuals who reside in the Republic of Singapore. It supplements and should be read together with the main section of this privacy notice. In the event of any conflict or inconsistency between this Appendix and the main body of this privacy notice, this Appendix shall prevail.

Consent

We will collect, use or disclose your Personal Data for purposes which you have provided your consent which can be express, deemed or by notification, unless exempted, in accordance with Singapore’s Personal Data Protection Act (2012) and its regulations (PDPA). Where we have collected, used or disclosed your personal data based on consent, you may withdraw consent with reasonable notice, and we will inform you of the likely consequences of the withdrawal.

Purpose limitation & notification

We will only collect, use or disclose Personal Data for the purposes that a reasonable person would consider appropriate under the given circumstances and for which you have given consent (unless exempted by law).

Accuracy, access & correction

We will make reasonable effort to ensure that your Personal Data collected is accurate and complete. You have right to access Personal Data which we hold about you, request a copy of that information and details of what we have done with that information (i.e., how long we kept it for and to whom we disclosed it) within a year before your request.

You have a right to request us to correct your Personal Data where it is inaccurate or out of date. We will make the necessary corrections as soon as practicable and send the corrected data to other organisations to which your Personal Data was disclosed pursuant to this privacy notice within a year before the correction was made.

Retention limitation

We will cease retention of your Personal Data or dispose of it in a proper manner if it is no longer necessary for the purpose for which it was collected and we have no other legal ground for processing the data, or if the collection, use or disclosure of your Personal Data was based on consent and the consent has been withdrawn.

Transfer limitation

For international transfers (i.e., a cross-border disclosure) of your Personal Data from Singapore to overseas, we will put in place contractual measures to ensure the overseas recipients process your personal data in accordance with our instructions and have in place technical and organizational measures to protect your personal data with a level of protection comparable to the protection under the PDPA.

Data breach notification

We will notify you of any data breach that is or is likely to be of significant scale, or results in or is likely to result in significant harm to you.

Data portability

Where required by law, at your request, we will transmit your Personal Data that is in our possession or under our control, to another organisation in a commonly used, machine readable format.

Marketing communication

We may send you marketing messages (e.g., voice calls, text or fax messages) to your Singapore telephone number, if we have an ongoing relationship with you or your Singapore telephone number is not listed in the Do Not Call Registry or we have obtained your clear and unambiguous written consent. You may at any time opt out of such messages by using the same medium by which the message is sent. Exceptions to the foregoing include our communications regarding services purchased by you, market survey or research and B2B messages.

Inquiries or complaints

If you have any requests to exercise rights, inquiries or concerns about the Personal Data we use about you, please contact our Data Protection Officer at dataprotection@icaew.com. If we are unable to help you, you may contact Singapore’s Personal Data Protection Commission (pdpc.gov.sg).