Fair processing notice: Users making a complaint or providing feedback

This fair processing notice applies to external parties, including AAT students, professional members, training providers and assessment venues, who want to raise a complaint or provide feedback, including compliments.

The data we collect about you

We need information from you to investigate your complaint properly, and to understand what's happened, or to process any general feedback in our endeavour for continuous improvement.

When we receive a complaint or feedback from you, we'll record details on our customer record and electronic document management system. This normally includes your contact details and any other information you've given us about the other parties involved in your complaint or feedback.

We need to know the details of your complaint, which will vary, so we can investigate it fully or action any general feedback.

We will use your personal information to investigate your complaint and check on levels of service. We compile and may publish statistics showing information like the number of complaints we receive, and feedback given, but not in a form that identifies anyone.

If you are acting on behalf of someone making a complaint, we'll ask for information to satisfy us of your identity and, if relevant, ask for information to show you have authority to act on someone else's behalf.

You should also refer to the "specific information about your data" section for details of how we process your data as part of an existing relationship you have with us, for example, as a member or student.

What we do with your data and on what grounds

We can process your personal data only if we have a basis to do so that is permitted by law. With regards to complaints and feedback these include:

• consent: we will use the personal data you provide to investigate your complaint or action feedback at your request
• for our performance of a contract with you: we process your personal data where it's necessary to fulfil a contract with you or to take steps, at your request, before entering such a contract, which may include investigating complaints regarding contractual obligations
• explicit consent: we may process personal data that you have provided voluntarily as part of your complaint, including special category data if provided. We process this data only with your explicit consent
• legal obligation: to meet our regulatory reporting obligations.

See also our fair processing notices for professional and licensed members for details of how we process your data if you are the subject of a complaint.

For details of your rights see our main privacy policy.

Automated decision making

No decisions will be taken about you using solely automated means because of submitting a complaint.

Who we share your personal data with

Normally, no other third parties will have access to your personal information provided as part of your complaint of feedback unless you have provided consent. This may include where it is necessary to investigate your complaint or action feedback, for example, where your complaint relates to a third party.

If you have provided consent, we may publish compliments as part of promotional material.

If you have made a complaint about an organisation, we usually have to disclose your identity to them. This is so we can clearly explain to them what you think has gone wrong and if necessary, advise them how to put it right. This also means we may receive information about you from them.

If you don't want information that identifies you to be shared with the organisation you want to complain about, we'll try to respect that if you ask us to. However, it is not always possible to handle a complaint on an anonymous basis, so we'll contact you to discuss this.

There are other circumstances where we may disclose your details, for instance where the law requires us to, or we have a legitimate reason, such as to seek legal advice. This may include:

• supervisory/regulatory bodies
• law enforcement, including HMRC and HM Treasury in cases involving financial crime such as money laundering or fraud
• our legal representatives.

In addition, where regulatory reporting requirements apply it may also include:

• Financial Conduct Authority (FCA)
• Department for Education (DfE)
• Office of Qualification and Examinations Regulation (Ofqual)
• other membership bodies.

Our use of data processors

Our third-party service providers include providers of IT systems and storage.

We use a third-party supplier of a Customer Relationship Management (CRM) IT system, based within the UK, to record details of complaints.

We also use Microsoft Office 365 to process email and for file storage, hosted within the EEA, and a third-party email archive system hosted within the UK.

We also use a third-party provider for our complaint/feedback forms which processes data in the EEA and USA.

Other third-party data processors might also include:

• AAT's Discipline and Conduct Panel members
• independent investigators working under contract for AAT.

Where a third-party data processor is used, we ensure that they operate under contractual restrictions regarding confidentiality and security, in addition to their obligations under data protection legislation. This means that they cannot do anything with your personal data unless we have instructed them to do it. They will not share your personal data with any organisation apart from us. They will hold it securely and retain it for the period we instruct.

Where we get your data from

Data provided as part of your complaint usually comes directly from you. We may also receive information from the individual or organisation your complaint relates to.

How long we keep your data

We will retain information relating to complaints and disputes for up to seven years following the resolution of the complaint or dispute (or, where a sanction has been imposed as a result, following the expiry of the sanction). This information may include data about the complainant and the subject of the complaint, and anyone else who is involved, for example a witness, as well as the details of the complaint and the outcome.

Transferring your data overseas

We transfer your data overseas to the European Economic Area (EEA) and USA, as detailed above, with regards to data processors.

Transfers to the EEA are based on the UK adequacy decision with regards to EEA countries.

Transfers to the USA are based on Standard Contractual Clauses (SCCs) and completion of a transfer impact assessment.

Related content

• Privacy policy
• Terms and conditions: use of AAT systems