Last updated: 7 March 2019
Bacs Payment Schemes Limited (Bacs) understands the importance of protecting your personal information.
If you need any further details, have a query or complaint about our use of your personal information, please contact our Data Protection Officer:
If you complete any of our online forms, the personal information you submit is stored on the bacs.co.uk website, the servers for which are located in the UK.
Registration of Primary Security Contacts
All service users of the Direct Debit and Bacs Direct Credit Scheme (the Scheme) are required by their sponsoring payment service provider (PSP) to provide personal information in the form of contact details of a nominated individual who will be the Primary Security Contact (PSC) for that service user. This information is registered on the PSW by the PSP Bacs uses this personal information for the following purposes:
Advice emails and compliance
As part of the Scheme, Bacs issues advice emails relating to changes in direct debit instructions (Automated Direct Debit Amendment & Cancellation Service (ADDACS)) and changes in Bacs direct credit payments (Advice of Wrong Account for Automated Credits Service (AWACS)). Where a service user fails to act on an ADDACS or AWACS advice email Bacs uses PSC personal information to send further advice emails . Each email includes a link to complete a form to request a call from our Service Desk if the service user requires further assistance.
If you choose to request a call, we collect and use the contact information you provide in the request a call form. The personal information provided in the form is used by our service desk suppliers to telephone the individual requesting help and assist with the query. In addition, our service desk suppliers check payee and payer records to make they are maintained as up to date as possible for future email.
Our service desk suppliers also use PSC personal information to make calls to proactively encourage advice emails to be actioned by service users. These telephone calls are not “request a call” telephone calls, but are made because an advice email has been sent to a PSC and have not been actioned. Bacs makes these calls to ensure its Direct Debit and Bacs Direct Credit Scheme functions properly and individuals’ automated payments are correctly made and received.
From time to time Bacs holds events relevant to specific audiences. These events are on an invitation only basis and where we invite PSCs, we use PSC personal information to email a link to a registration form for the event. Where you register for the event, the registration form captures as a minimum your name, contact details including your role and employer. Depending on the nature of the event, we may also ask for additional personal information which you can choose to provide.
We use event registration information to secure a place, send information relating to the event and to survey attendees to obtain feedback to improve future events.
From time to time, Bacs also uses the PSC personal information for the following additional purposes:
Where technical changes and improvements are required to maintain the integrity of the Scheme, personal information in the PSW may be shared with our key infrastructure supplier which delivers those changes at our request.
Documentation and service enhancements
Changes to the Bacs Guide and Rules, service updates, operational and product enhancements, new services and products and payment industry news are all communicated with service users using the PSC personal information in the PSW. These communications are vital to ensure all service users are aware of documentation and service enhancements. If you are no longer the PSC for your service user you can complete our contact us form to requesting that your personal information is deleted from the PSW.
Creation and distribution of reports
Bacs creates and shares reports relating to service user compliance, service users’ and Participants’ customers’ automated payment history including use of the Cash ISA Transfer Service and Account Switching Service and direct debit indemnity claims. These reports are shared with PSPs and service users where relevant. Depending on the type of report, we use service user PSC personal information and Participants’ customers’ personal information to create these reports.
Who do we share your personal information with?
Bacs shares personal information stored in the PSW with the following:
- Individual sponsoring PSP and collecting organisations;
- Our key infrastructure supplier; and
- Our third party suppliers who support the delivery of these services in accordance with the contractual arrangements we have in place with them. This includes:
- Service desk suppliers assisting with compliance with advice emails;
- Consultants who provides website management support;
- Agencies who support our communications and event activities; and
- Survey service providers.
Where required by law or competent authority we may also share your personal information with regulators, courts, government departments and law enforcement agencies. We will inform you of this before we share your personal information unless we are legally prevented from doing so.
Bacs does not, nor do any of the third party service suppliers with whom your personal information is shared by us, transfer any of your personal information outside the European Economic Area.
How long do we keep your personal information for?
Your personal information will be stored by Bacs while you are the PSC for your sponsoring PSP. Where we are required to retain your personal information indefinitely we will do so, for example, supporting claims made under the Direct Debit Guarantee.
How we protect your personal information
Bacs understands the importance of ensuring its systems are secure from unauthorised access, use or disclosure so that emails and forms that contain your personal information are safe. It has internal policies, procedures and controls in place to ensure this.
The law entitles you:
- To receive a copy of any of your personal information which we have collected
- To request that we correct and / or complete personal information we have collected
- To request that we permanently delete, stop using or storing any of your and / or restrict our use of your personal information when we no longer need it for the purpose you provided it to us
- To object to the processing of your personal information by us unless we can demonstrate that we need to continue processing it
- In some circumstances to request that we transfer your personal information to a third party.
If you would like to exercise any of these choices, please get in touch via our Data Protection Officer using the details above. Where we have shared your personal information with other companies, we will let them know if you exercise any of these choices.
If you believe that we have not complied with your data protection rights, you can complain to the Information Commissioner who can be contacted at www.ico.org.uk or by telephone on 0303 123 1113.