Introduction

This is the privacy notice of the Advertising Standards Authority Limited (ASA), the Advertising Standards Authority (Broadcast) Ltd (ASA(B)), the Committee of Advertising Practice Limited (CAP) and the Broadcast Committee of Advertising Practice Limited (BCAP), all companies with a registered office at Castle House, 37-45 Paul Street, London, EC2A 4LS. It is designed to inform you about how we collect and use your personal data, and is divided into the following sections:

1. What personal data do we collect?
2. Special categories of personal data
3. Children’s personal data
4. Legal bases for processing your personal data
5. Why we collect personal data
6. Disclosures to third parties
7. How we protect your personal data
8. Data retention
9. Your Rights in relation to your personal data
10. How to stop hearing from us
11. Our copyright statement
12. Changes to this privacy notice

We take our responsibility for the privacy and security of your personal data very seriously. This privacy notice tells you what to expect when we collect and process your personal data. We will ensure that:

  • any personal data you provide to us or we receive from other organisations is kept safe and secure;
  • we will be clear about our reasons for collecting and processing it; and
  • we will not do anything with it that you wouldn’t reasonably expect.

You have the right to complain to the Information Commissioner’s Office (ICO) if you have a concern about how we process your personal data and you can do this via ICO Concerns.

Our privacy notice is set out below. Please read this with care; it describes how we will process your personal data and what we will use it for. If you have any questions or comments, please contact us.

Contacting Us

If you have any enquiries, questions or concerns about the information contained in this privacy notice or more generally about how we collect and use your personal data, you can address these via email to [email protected], in writing to the Director of Corporate Services (who acts as the contact for all entities listed), ASA, Castle House, 37-45 Paul Street, London, EC2A 4LS, or by calling us on 020 7492 2222.

1. What personal data do we collect?

There are a number of scenarios where we collect personal data about you. In most instances, these are where you choose to provide personal data to us. We set out the different scenarios below:

Submitting a complaint

If you submit a complaint to us, the ASA and ASA(B) will collect the following information to process your complaint:

  • Your name (including title, first name and last name)
  • Your contact details (including email address, address, town / city, post code and country)
  • Your gender
  • Your complaint (including type of advert, product, description of complaint, date / time and advertiser)
  • Your employer and job title (if appropriate)
  • Any additional personal data you provide in your complaint
  • How you knew to complain to the ASA
  • How you prefer us to communicate with you
  • Whether or not you agree to participate in our customer satisfaction research

Requesting Copy Advice

If you use our copy advice service, CAP will collect the following information to process your request:

  • Your name (first name and last name)
  • Your contact details (including email address and contact number)
  • Your employer and job title (if appropriate)
  • Any additional personal data you provide in your enquiry
  • The company you are enquiring on behalf of (if appropriate)
  • Billing details (if appropriate)
  • Whether or not you agree to participate in our customer satisfaction research

Event booking

If you book onto one of our events, the ASA and CAP will collect the following information to inform you about the event, including times, content and venue:

  • Your name (first name and last name)
  • Your contact details (including email address and contact number)
  • Your employer and job title (if appropriate)
  • Booking and/or attendance details
  • Dietary requirements (where refreshment including lunch is provided)
  • Billing details (if appropriate)
  • How you prefer us to communicate with you

eLearning users

If you sign-up to our eLearning services, the ASA and CAP will collect the following information to manage the access to the eLearning products and courses:

  • Your name (first name and last name)
  • Your contact details (including email address and contact number)
  • Your employer and job title (if appropriate)
  • Module details

ASA/CAP website account holders

If you register on our website, the ASA and CAP will collect the following information to identify you with your account:

  • Your name (first name and last name)
  • Your contact details (including email address and contact number)
  • Your employer and job title (if appropriate)
  • Newsletter subscriptions
  • How you prefer us to communicate with you
  • Your areas of interest in our work

Consultation respondents and project participants

If you respond to a consultation or participate in a project, CAP and/or BCAP will collect the following information to provide you with the outcome of the consultation which will include the views of other respondents:

  • Your name (first name and last name)
  • Your contact details (including email address and contact number)
  • Your employer and job title (if appropriate)
  • Any additional personal data you provide
  • Response or participation details
  • Your requirements about confidentiality

Advertiser / Agency/ ASA investigations/ CAP sanctions investigations

The ASA/ASA(B)  will contact advertisers and agencies where a complaint has been made against them and / or their products. Additionally, CAP may engage with you about your advertising or apply sanctions. In such circumstances we will collect:

  • Your name (first name and last name)
  • Your contact details
  • Your company name and company contact details
  • Your email address
  • Your job title (if appropriate)
  • Background information on your business and practices

We rarely need to share complainants’ personal data with advertisers; however, when we do this we will seek to obtain the consent of the complainant before doing so. 

Referral to Clearance Centres

The ASA and ASA(B) work with organisations which act as ad clearance centres e.g. Clearcast and Radiocentre and when we receive complaints about an ad we may need to contact the clearance centres to understand their rationale for clearing the ad; this may involve sharing correspondence that may include the personal data of named contacts at the relevant advertiser. The personal data that may be shared is:

  • Contact name (First Name and Last Name)
  • Your email address
  • Your job title

Some complainant details may also be seen by the clearance centres, where this is the case we will gain the consent of the complainant before doing so.

Transfer from other regulatory bodies

If a complaint is transferred to us from another regulatory body, the ASA and/or ASA(B) will collect the following information to process that complaint:

  • Your name (including title, first name and last name)
  • Your contact details (including email address, address, town / city, post code and country)
  • Your gender
  • Your complaint (including type of advert, product, description of complaint, date / time and advertiser)
  • Your employer and job title (if appropriate)
  • Any additional personal data you provide in your complaint

Subscribing to newsletters

If you subscribe to one of our newsletters, the ASA or CAP will collect the following information to enable us to provide the requested service in a timely manner:

  • Your name (first name and last name)
  • Your company
  • Your email address
  • Your job title (if applicable)

General enquiries:

If you submit a general enquiry to us, the ASA and/or CAP will collect the following information to enable us to respond to your enquiry and contact you to provide any additional information:

  • Your name (first name and last name)
  • Your contact details (including email address, address and contact number)
  • Any additional personal data you provide in your enquiry
  • Your enquiry details

Customer satisfaction surveys

Sometimes when you submit a complaint or seek copy advice, the ASA and/or CAP may use a research organisation to contact you to see whether you will participate in an anonymised Customer Satisfaction Survey; while such organisations act as processors of  your personal data on our behalf, we are responsible for your personal data at all times. If you don’t wish to take part just let us know, by updating the preferences on your account, calling us on 020 7492 2222, emailing us at [email protected] or writing to us at  ASA, Castle House, 37-45 Paul Street, London, EC2A 4LS.

Job Applicants

If you apply for a role at the ASA/ASA(B) or CAP/BCAP, we will collect the following information to enable us to process your application efficiently and provide you with additional information:

  • Your Name (forename, last name other names)
  • Your title
  • Your contact details (including address, town, county, post code, email address and contact telephone number)
  • Other personal data (Including nationality, gender and date of birth)
  • Special category data (used for monitoring purposes, including ethnic origin, religion and sexual orientation)
  • Any additional information required to process your application (including a question on your right to work, any disability (optional), qualifications (secondary, further education or professional), career history, skills and experience for the role and where you saw the advertisement)

Where we request special category data, you have the option in each case to select ‘other’ or ‘prefer not to say’.

If you are selected for interview then we have a legal obligation to collect and process information which proves your right to work including a work permit, copy of a passport or a copy of a visa, and will do so on the basis of this legal obligation.

Social Media

Depending on your settings and the privacy policies for social media and messaging services like Facebook, WhatsApp or Twitter, you might give us permission to access personal data about you from those accounts or services. 

We use a third party service  providers providing us with marketing services, to manage our social media interactions such as responding to general enquiries made to us or distributing useful information on advertising practice and compliance. If you send us a message through this medium that information will be stored on Hootsuite and securely deleted after 3 months. We do not share any of this information with any other third parties.

Through our website

Like most websites, we use “cookies” and other tracking technologies to help create a better experience for you when using it. Cookies allow a website to remember you; they are small text files that sites transfer to your computer (or phone or tablet). They make interacting with a website faster and easier – for example by automatically filling your name and address in text fields. For further information please see our Cookie policy

In addition, the type of device you’re using to access our website and the settings on that device may provide us with information about your device, including what type of device it is, what specific device you have, what operating system you’re using, what your device settings are, and why a crash has happened. Your device manufacturer or operating system provider will have more details about what information your device makes available to us and how you can control that.

2. Special categories of personal data

Data protection law defines special categories of personal data as personal data revealing:

  • racial or ethnic origin;
  • political opinions;
  • religious or philosophical beliefs; or
  • trade union membership;

These categories also include:

  • genetic or biometric data processed for uniquely identifying individuals; and
  • data concerning health, sex life or sexual orientation.

We will not ask you for this information, except if you apply for a job with us, at which point you can opt to ‘prefer not to say’; however, you may provide some of this information in support of your complaint or enquiry to us. Please see Section 4 below for further information about the basis upon which we use special category data.

3. Children’s personal data

Persons aged 13 and under should not use our services.

If your complaint relates to a person under the age of 16 who has received advertising for unsuitable products, e.g. gambling, alcohol, tobacco, or direct marketing without consent then before we disclose any of their personal data in the context of dealing with your complaint, we will contact you to gain your consent to disclose this personal data in order to achieve satisfactory resolution of your complaint; if you do not give your consent, we will not process this personal data about children. 

4. Legal bases for processing your personal data

The legal bases we will usually rely on are:

  • Legitimate interest;
  • Performance of a task carried out in the public interest or in the exercise of official authority vested in us; or
  • Contract; or
  • Consent.

Legitimate Interests

We set out below the key circumstances where we rely on the legitimate interest basis:

  1. In most instances, individuals supply us with their personal data with the intention and expectation that we will investigate their complaint or process the enquiry that they have made to us and provide them with a satisfactory outcome, and we therefore have a legitimate interest in processing their personal data for this purpose. We are not able to carry out our purposes as an advertising regulator without processing certain personal data about the individuals who bring complaints.
  2. We have a legitimate interest in processing personal data provided to us in our role as the UK advertising regulator investigating complaints, supplying copy advice, taking compliance and enforcement action and carrying out consultations. We cannot carry out our role without receiving complaints from individuals and organisations which necessarily involves the processing of personal data. One of our key objectives is to investigate and rule on complaints concerning advertising to assess whether an ad has broken the advertising rules. We use personal data collected in the course of our investigations to achieve this objective but we do not use personal data through this process to target individuals or to impact them in a negative way unless they are the subject of an investigation due to a suspected breach of our rules. We only collect the minimal amount of personal data necessary to carry out our role as the UK advertising regulator and we put in place safeguards to ensure that any personal data provided to us is only used for limited purposes.
  3. We also have a legitimate interest in contacting advertisers and agencies when handling complaints made against them, to gather the evidence necessary in support of any investigation and subsequent ruling that may be made, including providing them with the opportunity to participate in this process and provide a defence of their advertising.  This may include the recording of personal data to contact them to obtain any additional information or, in the case of complaints about competitors, to inform the complainant of the outcome of an investigation into their complaint. The personal data we collect as part of this process is not ordinarily the main focus of our investigation but is necessary in order for us to meet our objectives as the UK’s advertising regulator.
  4. In certain instances we will want to ensure that the personal data we hold on individuals is accurate. This is necessary for us when we are investigating complaints so that we ensure we achieve our objectives in a fair way based on credible information. Therefore we have a legitimate interest in accessing publicly available information found on Companies House, Post Office’s National Change of Address database, whois.com, websites and other reputable sources, to ensure that the records we hold about individuals is accurate.
  5. We also have a duty to provide a safe working environment for our staff. In accordance with our Unacceptable Contact policy (see here) we have a legitimate interest to process personal data on individuals who behave in an unacceptable way towards our staff and we will, where we consider necessary and proportionate, restrict such individual’s ability to communicate with us. 

You have a right to object to your personal data being used on the basis of legitimate interests. However, in most cases, we will not be able to investigate your complaint if you exercise this right to object. Alternatively we may have a compelling legitimate ground to continue to process your personal data in the context of our role as the UK’s advertising regulator despite your objection.

Performance of a task carried out in the public interest.

The ASA and CAP carry out a public function in the public interest in drafting the CAP Code and handling complaints concerning non-broadcast advertising in the UK.  In respect of unfair business to consumer commercial practices (including misleading advertising) the ASA and CAP are recognised as being the  established means for dealing with such complaints (regulation 19(4) of the Consumer Protection from Unfair Trading Regulations 2008).

BCAP and ASA(B) have a specific role under authority from Ofcom (www.ofcom.org.uk)  in respect of broadcast (TV and radio) advertising standards/ code drafting/ revision and complaint handling/ resolution. This role is set out in law (under the Communications Act 2003 sections 319-324) and has been contracted out to BCAP and ASA(B) by Ofcom under the Contracting Out (Functions relating to Broadcast Advertising) and Specification of Relevant Functions Order 2004. For more information see: https://www.ofcom.org.uk/tv-radio-and-on-demand/how-to-report-a-complaint/what-does-ofcom-cover.

Contract

If you choose to purchase a CAP eLearning service or try one of our free demos, we will need to process certain personal data in order to fulfil your request. When you register for an eLearning module and pay online at the time of registration, you will have immediate access. If you choose to nominate your employer to pay for the eLearning, we will contact you, with your access details, to provide you with the courses you have purchased.

Consent

Where we send you emails about our services or you sign up to our newsletters, we will only do so having collected your prior consent. You can revoke your consent at any time by accessing your online account (if you have one with us), emailing us at [email protected] (quoting your complaint reference number) or calling us on 020 7492 2222.

When we use special category data

While we do not intentionally seek to collect special category data, we recognise that in certain contexts we will use such data in order to properly carry out our remit to handle advertising complaints. In such circumstances, we will need to use special category data for substantial public interest reasons due to compliance with one of the following: (i) our specifically given functions under law, (ii) to ensure equality of opportunity or treatment, or (iii) to take steps to establish whether an advertiser is involved in malpractice.

5. Why we collect personal data

We collect personal data for the following purposes:

  • To process your complaint, including those based on database practice and prize promotion, enquiry and event booking
  • To request additional information and provide feedback to you about your complaint
  • To identify you in relation to requesting additional information or feedback about your complaint, enquiry or advice you have requested
  • To investigate advertiser compliance with the CAP and BCAP codes, publish rulings concerning such compliance,  and seek assurance of compliance with these codes
  • To pass to other regulatory bodies in the UK or other countries to enforce sanctions
  • To keep a record of your relationship with us including general communications
  • To ensure we know how you prefer to be contacted
  • To provide you with information and access to services that you have requested from us or which we feel may be of interest to you, where you have consented to be contacted for such purposes.
  • To process an application for a role at the ASA/ASA(B)/CAP/BCAP
  • We may also use your personal data to detect and reduce fraud in order to protect our interests.

Handling your complaint

We collect, store and process the personal data you supply to us on the basis of legitimate interest (please see further below) to handle, manage and provide you with information and advice about your complaint that you have voluntarily submitted to us. We may also contact you, to request additional information that we may need about your complaint. If your complaint is about something that is not covered by our rules, we may be able to refer it to another regulatory body in the UK that could consider your complaint. Alternatively, we may decide to send it to another advertising regulator outside the UK if the ad falls within their jurisdiction.  We will only do so where, either the country where the regulatory body is located is specified, through UK adequacy regulations, as providing an adequate level of protection for personal data, or because we have implemented appropriate safeguards to protect your personal data. Further information on this can be found in our ‘How we protect your personal data’ section. A referral will involve passing on your personal contact details as well as your complaint. 

We have a legitimate interest in passing your personal data on to a relevant third party to administer your complaint if it relates to database practice or a prize promotion which you have asked us to pursue on your behalf.

If we need to pass your personal data on to another regulatory body or relevant third party to pursue a resolution for you in the most effective way, we will tell you that we are doing so. If you have submitted a complaint to us we may invite you to take part in anonymised customer satisfaction surveys; we send such requests on the basis of a legitimate interest in improving our services that we provide to you. If you do not wish to take part, you have the right to opt out of the surveys at any time by contacting us at the address in the ‘Contact Us’ section or changing your contact preferences in your account, if you have one with us.

Advertising compliance / applying sanctions

In addition to personal data we collect from you in support of our compliance work, we will contact you and inform you of the enforcement action we are proposing to take against you. If you do not follow any agreement that we come to, we may also pass your personal data on to other regulatory bodies or organisations which enforce sanctions; we do this on the basis of a legitimate interest in protecting the public from misleading advertising, and in ensuring that advertising is responsible. We may pass your information to one or more sanction partners who may be located in the UK or other countries, and may publicise any such referral. The organisations include:

  • Ofcom (Ofcom.org.uk)
  • Clearcast (Clearcast.co.uk)
  • Radiocentre (Radiocentre.org)
  • National Trading Standards (nationaltradingstandards.org)
  • Regional trading standards
  • The Competition and Markets Authority (gov.uk/organisations/competition-and-markets-authority)
  • The Gambling Commission (gamblingcommission.gov.uk)
  • The Phone Paid Services Authority (psauthority.org.uk)
  • The Information Commissioner’s Office (ico.org.uk)
  • The Medicines and Healthcare Products Regulatory Agency (gov.uk/government/organisations/medicines-and-healthcare-product-regulatory-agency)
  • Food Standards Agency (www.food.gov.uk)
  • Financial Conduct Authority (www.fca.org.uk)
  • European Advertising Standards Alliance (www.easa-alliance.org)

We have agreements in place e.g. memorandums of understanding, with some sanction partners that we work with, and we will pass your personal data on to any of those sanction partners (on the basis of that agreement) who are best placed to undertake any enforcement actions; we may also pass your personal data onto sanction partners (as part of a compliance case) that we do not have agreements with. We will ensure, where permitted and appropriate, that you are informed about these disclosures. You should read the privacy notice of the sanction partner that we pass your personal data onto to see how they will process your personal data and the nature of any safeguards they have in place to protect your personal data.

Providing copy advice

Where you ask us to provide you with copy advice, we will process the personal data that you provide to us on the basis of legitimate interest in order to supply you with that copy advice; on some occasions we use industry experts and, where this is the case, we do not supply your personal data to them. In addition, we do sometimes receive requests from other regulatory bodies to release information about specific advice received, e.g. Trading Standards. We do not usually share any specific information about who received the copy advice unless we can prove that the enquirer works closely with or is from the same organisation or we are under a legal obligation to provide the information. 

If a complaint has been made where copy advice has been provided, then that advice will be provided to the ASA as part of the investigation.

Consultations and projects

CAP and BCAP undertake a number of public consultations each year; they have a legitimate interest in ensuring that the consultation process is transparent and complies with relevant legal principles governing public consultation. In their evaluation document, CAP and BCAP will publish all the relevant significant comments made by respondents.

We will not publish the personal data of consultation respondents unless it is the name of a member of the public with a public profile and their identity is relevant context to their response. When publishing such names, we do so on the basis of a legitimate interest in ensuring transparent and accountable decision-making.

All responses will be included in any statistical summary of numbers of comments received.

Event Booking

We will process personal data on the basis of your legitimate interest when you book onto an event and we will contact you with details of the event, the venue, location and timings.

e-Learning

CAP eLearning at www.caplearning.org.uk  is a training resource owned by CAP and created in conjunction with and administered by third party providers supplying the resources to us. If you choose to purchase eLearning services from CAP we will need to process certain personal data in order to perform the contract of services. When you register for an eLearning module and pay online at the time of registration, you will have immediate access. If you choose to nominate your employer to pay for the e-learning, we will contact you, with your access details, to provide you with the courses that you have purchased.

We carry out analysis of the use of our e-learning modules on a regular basis to monitor and improve our modules. To do this analysis we will use learner data of those individuals that have started and completed our courses. The personal data that we use is held on ASA servers and, once the analysis has been completed, we securely delete all personal data held for this purpose. We will not sell, rent or exchange your details with any third party organisations.

Direct Marketing

We will contact you (in accordance with your preferences especially where we are required to obtain your consent to use a particular marketing channel) with information from the ASA and CAP about our work (for example, guidance) to help you comply with the UK Advertising Codes, which may include paid-for services such as our online training and events. We will not share your personal data with other organisations for marketing purposes. Our marketing communications have clear marketing preference questions, and we include information on how to opt out whenever we send you marketing. If you don’t want us to contact you, you can update your preferences at any time; this can be found in our ‘How to stop hearing from us’ section below.

Where you decide not to receive any direct marketing communications from us, we will add your name to our marketing suppression list; this will require the retention of a small amount of your personal data (e.g. name and email address) to make sure that your name can be excluded from any future mailings.  If you have requested that your personal data be erased, we will retain this small amount of personal data on our suppression list and you will be advised accordingly.

Newsletters

Our e-newsletters are used to inform you of news related to the ASA and CAP, including events and other useful resources such as eLearning modules to further support the drive for compliant advertising. If you have subscribed to one of our newsletters we will send them to you on the basis of your consent that you have provided to us by subscribing.

We use a third party provided product, Dotmailer, to deliver our newsletters; we gather statistics about the email opening and clicks using standard industry technologies. This helps us monitor and improve our newsletters, providing you with content that we believe is of greater interest to you. 

We will not share our newsletter subscription lists with any other organisations. You can remove your name from any of our newsletter subscription lists at any time; you can see how to do this is under the section ‘How to stop hearing from us’ below.

Job Applications

If you have applied for a role at the ASA/ASA(B) or CAP/BCAP we will process your personal data on the basis of legitimate interest, provided at the point of application. The application process asks for some special category data (e.g. religious or philosophical beliefs, race or ethnic origin, sexual orientation and disability) but you do not have to supply this and can select ‘other’ or ‘prefer not to say’; We use this data to report on the diversity of our applicants, those shortlisted and the offers made; we also use this data to monitor our progress in one of our stated aims of being reflective of society. If you do supply this information we will contact you to gain your explicit consent to do so.

General Enquiries

If you submit an enquiry to us we will process the personal data that you provide on the basis of a legitimate interest in responding to the enquiry that you have submitted to us. If your enquiry is not one which we are best placed to deal with we will direct you to the appropriate organisation; we may also pass your enquiry onto another regulatory body and, if we do this, we will let you know.

6. Disclosures to third parties

We reserve the right to disclose your personal data to third parties:

  • In order to facilitate and deal with your complaint or a complaint made against you i.e. another regulatory body;
  • if we are under any legal or regulatory duty to do so; and/or
  • to protect our rights, property or the safety of us, our personnel, users, visitors or others.

We also use third party service providers as our processors to only hold and use personal data on our behalf in order to provide us with a service.  We may also disclose personal data to our professional advisors and experts in order to obtain their assistance in carrying out our services and our activities.

We offer paid-for services e.g. express copy advice; event booking, e-learning, and the payment for these are handled directly by third parties SagePay and PayPal. No credit or debit card information is stored by us. We have access to confirmed payment information, which is necessary for us to confirm payment and provide the service for which you have contracted with us to provide.

7. How we protect your personal data

We have access to shared systems and data; all access to personal data is managed through individual access permissions, which means that individuals only have access to personal data when it is appropriate for them to do so (this is known as the principle of least privilege). Where an individual is unable to access personal data that they believe they have the right to, for their role, the requirement for their access to personal data is checked with their line management.

Your personal data is held on secure servers in the UK and we ensure that there are appropriate technical controls in place to protect your personal data.  For example, our online forms are always encrypted and our network is protected and routinely monitored. The transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your personal data when you transmit it to our site.

If we use external companies to collect or process personal data on our behalf, we undertake checks before we begin work with them, and put a contract in place that sets out our expectations and requirements e.g. non-disclosure agreements and expected levels of security; especially regarding how they manage the personal data they collect or have access to.  

International data transfers

Some of our partner organisations may run their operations outside the UK. The UK Government has assessed a number of countries and determined that their data protection legislation has sufficient safeguards and is adequate to enable the transfer of personal data to recipients in these countries. Where a recipient of your personal data is based in a country which has not been declared adequate by the UK Government, we will ensure that your personal data is transferred in a manner that meets the requirements of applicable data protection law and, where appropriate, implement safeguards. Such appropriate safeguards may include standard contractual clauses adopted by a data protection regulator. We have a legitimate interest in the transfer of your personal data to a location outside the UK where it furthers the satisfactory resolution of your complaint. If you wish to object to such transfers, you may do so via the contact details set out above.

We may also transfer your personal data to recipients in countries outside the UK in circumstances where it is requested under the laws of such countries. In such cases, we will review the level of personal data being requested and if it is considered appropriate to transfer the data, we will inform you that this is the case.

If you have any questions about the transfer of personal data outside the UK, you can contact us using the details set out above.

8. Data retention

When you supply personal data to us to handle your complaint or enquiry, we will retain it in line with our data retention policy. Personal data is retained for the purpose and the length of time necessary for which it was collected i.e. to handle the complaint and pursue our investigation. We may also be under a legal obligation to retain personal data for a specific period and compliance with our legal obligation may limit the right of an individual to have their personal data erased. Where you exercise your rights under data protection law (e.g. the right to have your personal data erased) and this conflicts with any requirement or need for us to retain personal data you will be advised that this is the case and we will give you the timeframe within which we expect to comply with your right.

9. Your Rights in relation to your personal data

You have the right to be informed about what personal data is collected and how that is used; this information is contained in this privacy notice in the section ‘What personal data do we collect’.

You have the right to ask us to erase all the personal data that we hold about you, and if it is no longer necessary for the purpose for which you provided it to us (e.g. processing your complaint / enquiry) and it is lawful for us to do so, we will erase your personal data and provide you with the outcome of that process. 

You have the right to object to processing of your personal data, to stop us processing your personal data or restrict processing of your personal data, and if it’s no longer necessary for the purpose for which you provided it to us (e.g. processing your complaint or enquiry or registering you for an event) we will do so. Please contact us if you have any concerns.

You have a right to ask for a copy of the personal data we hold about you, although if the effort to provide such personal data is disproportionate (because of manifestly unfounded or excessive requests) then we may charge for processing these requests.  

You have the right to have your personal data rectified, where it is shown to be inaccurate or incomplete; if there are any discrepancies in the personal data we use about you, please let us know and we will correct it.

You have the right to seek portability of your personal data in certain circumstances where we are relying on the lawful bases consent or performance of a contract to process your personal data.

If you want to access your personal data, please send a description of the personal data you want to see to [email protected] or write to the Director of Corporate Services  at The ASA, Castle House, 37-45 Paul Street, London, EC2A 4LS. We may request proof of identity to ensure that we only provide the personal data to the right person.

If you have any questions or wish to exercise any of your rights please contact [email protected], and for further information see the Information Commissioner’s guidance here (link is external).

You have the right to lodge a complaint with the Information Commissioner’s Office.

10. How to stop hearing from us

If you decide that the information we provide to you is no longer relevant or interesting to you and you do not wish to hear from us any more, it would be useful for us to understand the reasons; you may change your contact preferences at any time by updating your preferences via your online account or emailing us at [email protected], or calling us on 0207 492 2222 or writing to us at The Advertising Standards Authority, Castle House, 37-45 Paul Street, London, EC2A 4LS.

11. Our Copyright statement

All material either on this website or provided in hard copy is owned by or licensed to the ASA, ASA(B), CAP or BCAP, and is protected by registered and/ or unregistered trademark rights, copyright, or other proprietary rights and laws.  

Unless indicated as Crown-owned material or otherwise, the material featured on this website or provided in hard copy may be reproduced free of charge in any format or medium, provided that it is reproduced accurately and not used in a misleading context. The material must be acknowledged as ASA copyright and the title of the document/publication specified.

Any enquiries regarding the material on this website should be addressed by email to [email protected] or by letter to The Advertising Standards Authority, Castle House, 37-45 Paul Street, London, EC2A 4LS.

12. Changes to this Privacy Notice

If we decide to change our Privacy Notice, we shall post changes on this webpage and update the relevant sections in our publications where we display how we use your personal data so that you are always aware of how CAP and the ASA use your personal data. If we make significant changes to our Privacy Notice, we will use reasonable efforts to contact you to notify you of such changes.

This page was last updated on 1 July 2021.