Firstly, we are under a legal obligation to let you know what personal information we collect about you, what we use it for and on what basis. We always need a good reason and we also have to explain to you your rights in relation to that information. You have the right to know what information we hold about you and to have a copy of it, and you can ask us to change or sometimes delete it.
But whatever we do with your information, we need a legal basis for doing it. We generally rely on one of three grounds (reasons) for our business processing. Firstly, if you have ordered or take a service from us, we are entitled to process your information so that we can provide that service to you and bill you for it.
Secondly, if we want to collect and use your information for other purposes, we may need to ask for your consent (permission) and, if we do, that permission must always be indicated by a positive action from you (such as ticking a box) and be informed. You are also free to withdraw your permission at any time. We tend to need permission when what is proposed is more intrusive (for example, sharing your contact details with other organisations so they can market their own products and services to you).
But we do not always need permission. In some cases, having assessed whether our use would be fair and not override your right to privacy, we may come to the view that it falls within the third ground – our ‘legitimate interests’ to use the information in a particular way without your permission (for example, to protect our network against cyber-attacks). But when we do this, we must tell you as you may have a right to object. And if you object specifically to us sending you
marketing material, or to ‘profiling you’ for marketing purposes, we must then stop.
This is all set out in detail in this policy, which focuses more on those items that we think are likely to be of most interest to you. As well as covering processing for business purposes, we give you information on circumstances in which we may have to, or can choose to, share your information.
Please read this policy carefully as it applies to the products and services we provide to you (such as your phone, mobile, WiFi, TV and broadband), our apps and our websites. It applies to our consumer, sole trader and partnership customers but doesn’t apply to the information we hold about companies or organisations.
It also applies even if you’re not one of our customers and you interact with us as part of us running our business, such as by:
Technology is a fast-changing area and can be complicated. We’ve included a glossary which explains the meaning of any technical terms we use.
You should review their privacy policies before giving them your personal information. Who are we?
At BT Federal, we’re part of a larger group of companies. Some other companies and parts of the BT Group have their own privacy policies. And they’ll apply if you buy your product or service direct from them, but the EE and Plusnet policies are broadly similar to this one.
You can access and update the information we hold about you by contacting our data-protection officer by email email@example.com Once we’ve looked at your request, we’ll let you know when you can expect to hear from us.
We’ll always try to help you with your request but we can refuse if we believe doing so would have a negative effect on others or the law prevents us. And even though we have to complete your request free of charge, we are allowed to reject requests if:
If that’s the case, we’ll explain why we believe we don’t have to fulfil the request. Fed up with getting marketing from us?
You can opt out of receiving marketing from us at any time using the link provided in the email or SMS message (text message) we have sent you or just by telling us when we call you. Or you can contact our data-protection officer by email firstname.lastname@example.org.
Or, let us know whether you want us to stop using information about how you use our products and services (your call, browser and TV records) for marketing purposes or profiling you for marketing purposes. For more information about how we use your information for marketing purposes, please see below.
You can ask us for a copy of the information we hold about you by contacting our data-protection officer by email email@example.com.
If you work for one of our corporate customers, please ask your employer – they’ll ask for this on your behalf.
It will normally take us up to one month to get back to you but could take longer (up to a further two months) if it’s a complicated request or we get a lot of requests at once.
We’ll reply electronically unless you ask us to send the information by post. Concerned about what we’re doing with your personal information?
You can ask us to correct, complete, delete or stop using any personal information we hold about you by contacting our data-protection officer by email firstname.lastname@example.org or write to the address below and mark it for their attention.
BT Federal Inc.
11440 Commerce Park Drive, Suite 100
Reston, VA 20191
If you’re worried about how we send you marketing information, have a look at the section above on how to check or change those settings.
If you want us to stop using personal information we’ve collected via cookies on our website or apps, you should either change your cookie settings or change the settings for your app. In some cases, we might decide to keep information, even if you ask us not to. This could be for legal or regulatory reasons, so that we can keep providing our products and services, or for another legitimate reason. For example, we keep certain billing information to show we have charged you correctly.
But we’ll always tell you why we keep the information.
We aim to provide our products and services in a way that protects information and respects your request. Because of this, when you delete or change (or ask us to delete or change) your information from our systems, we might not do so straight away from our back-up systems or copies on our active servers. And we may need to keep some information to fulfil your request (for example, keeping your email address to make sure it’s not on our marketing list).
Where we can, we’ll confirm any changes. For example, we’ll check a change of address against the Postal Address File, or we might ask you to confirm it.
If we’ve asked for your permission to provide a service, you can withdraw that permission at any time. It’ll take us up to 30 days to do that. And it only applies to how we use your personal information in the future, not what we’ve done in the past (for example, if we’ve run a credit check at the start of your contract).
If we provide you with our products and services, or you’ve said we can use your information, you can ask us to move, copy or transfer the information you have given us. You can ask us to do this by contacting our data-protection officer by email email@example.com.
We’ll send your personal information electronically. And we’ll do our best to send it in another format if needed.
We’ll always try to help you with your request. But we can refuse if sharing the information would have a negative effect on others, for example because it includes personal information about someone else, or the law prevents us from doing so. It will normally take us up to one month to get back to you but could take longer (up to a further two months) if it’s a complicated request or we get a lot of requests at once.
What kinds of personal information do we collect and how do we use it?
The personal information we collect depends on the products and services you have and how you use them. We’ve explained the different ways we use your personal information below.
We’ll use your personal information to provide you with products and services. This applies when you register for or buy a product or service from us. Or if you register for an online account with us or download and register on one of our apps.
This means we’ll:
We use the following to provide products and services and manage your account.
We use this information to carry out our contract (or to prepare a contract) and provide products or services to you. If you don’t give us the correct information or ask us to delete it, we might not be able to provide you with the product or service you ordered from us.
If you tell us you have a disability or otherwise need support, we’ll note that you are a vulnerable customer, but only if you give your permission or if we have to for legal or regulatory reasons. For example, if you told us about a disability we need to be aware of when we deliver our services to you, we have to record that information so we don’t repeatedly ask you about it. We will also record the details of a Power of Attorney we have been asked to log against your account.
We’ll use your personal information if we consider it is in our legitimate business interests so that we can operate as an efficient and effective business. We use your information to:
We’ll use your personal information to send you direct marketing and to better identify products and services that interest you. We do that if you’re one of our customers or if you’ve been in touch with us another way (such as entering a prize promotion or competition).
This means we’ll:
We use the following for marketing and to identify the products and services you’re interested in.
We’ll send you information (about the products and services we provide) by phone, post, email, text message, online banner advertising or a notice using our apps or on your TV set-top box. We also use the information we have about you to personalise these messages wherever we can as we believe it is important to make them relevant to you. We do this because we have a legitimate business interest in keeping you up to date with our products and services, making them relevant to you and making sure you manage your spending with us. We also check that you are happy for us to send you marketing messages by text or email before we do so. In each message we send, you also have the option to opt out.
We’ll only use your call, browser and some TV records (such as programmes you watch on channels we provide that are produced by other organisations) to personalise our offers as long as you are happy for us to do so.
We’ll only market other organisations’ products and services if you have said it is OK for us to do so.
You can ask us to stop sending you marketing information or withdraw your permission at any time, as set out above.
We’ll use your personal information to create aggregated and anonymised information. Nobody can identify you from that information and we’ll use it to:
We use the following information to do this.
If we use this information for market research, training, testing, defend or bring claims, development purposes or to create a profile about you, we do so because it is in our legitimate business interests of running an efficient and effective business which can adapt to meet our customers’ needs.
We create a profile about you based on what you have ordered from us and how you use our products and services. This helps us tailor the offers we share with you. You can ask us to stop profiling you for marketing purposes at any time, as set out above.
Before we provide you with a product or service (including upgrades or renewals), or sometimes when you use our products and services, we’ll use personal information you have given us together with information we have collected from credit reference agencies (such as Experian or Equifax), the Interactive Media in Retail Group (IMRG) security alert, or fraud prevention agencies (such as Cifas). We use this information to manage our credit risk, and prevent and detect fraud and money laundering. We’ll also use these organisations to confirm your identity. When they get a search from us, a 'footprint' goes on your file which other
organisations might see. We might also share the information with other organisations. We do this because it’s in our, and the organisations’, legitimate interests to prevent fraud and money laundering, and to check identities, to protect our business and to keep to laws that apply to us.
Details of the personal information that will be used include your name, address, date of birth, contact details, financial information, employment details and device identifiers, including IP address and vehicle details.
If you don’t become one of our customers, we’ll still keep the result of our credits checks about you if we have a legal obligation and it’s in our legitimate interests to help prevent or detect fraud. Fraud prevention agencies can hold your personal information for different periods of time, and if you are considered to pose a fraud or money laundering risk, your information can be held by us and the organisations we share it with for up to six years.
If you give us false or inaccurate information which we identify as fraudulent, we’ll pass that on to fraud prevention agencies. We might also share it with law enforcement agencies, as may the agencies we have shared the information with.
If you tell us you’re associated with someone else financially (for example, by marriage or civil partnership), we’ll link your records together. So you must make sure you have their agreement to share information about them. The agencies we share the information with also link your records together and these links will stay on your and their files – unless you or your partner successfully asks the agency to break that link.
If we, a credit reference or fraud prevention agency, decide that you are a credit, fraud or money laundering risk, we may refuse to provide the services or financing you have asked for, or we may stop providing existing services to you.
The credit reference and fraud prevention agencies will keep a record of any fraud or money laundering risk and this may result in other organisations refusing to provide services, financing or employment to you. If you have any questions about this, please contact us using the details below.
We send credit reference and fraud prevention agencies information about applications, and they keep that information. We might also give them details of your accounts and bills, including how you manage them. This includes telling them about your account balances, what you pay us and if you miss a payment (going back in the past, too). So if you don't pay your bills on time, credit reference agencies will record that. They, or a fraud prevention agency, might tell others doing similar checks – including organisations trying to trace you or recover money you owe them.
There are different credit reference agencies in the UK (for example, Callcredit, Equifax and Experian). Each one might hold different information about you. If you want to find out what information they have on you, they may charge you a small fee.
Whenever credit reference and fraud prevention agencies transfer your personal information outside of the European Economic Area, they place contractual responsibilities on the organisation receiving it to protect your information to the standard required in the European Economic Area. They may also make the organisation receiving the information subscribe to ‘international frameworks’ aimed at sharing information securely.
Here are links to the information notice for each of the three main Credit Reference Agencies.
Experian - http://www.experian.co.uk/crain/index.html
If you don’t pay your bills, we might ask a debt-recovery agency to collect what you owe. We’ll give them information about you (such as your contact details) and your account (the amount of the debt) and may choose to sell the debt to another organisation to allow us to receive the amount due.
We’ll use your personal information to help prevent and detect crime and fraud. We’ll also use it to prevent and detect criminal attacks on our network or against your equipment. We monitor traffic over our network, trace nuisance or malicious calls, and track malware and cyber-attacks.
To do that we use the following information, but only where strictly necessary.
We use this personal information because we have a legitimate interest in protecting our network and business from attacks and to prevent and detect crime and fraud. We also share it with other organisations (such as other communications providers and banks) who have the same legitimate interests. Doing this helps make sure our network works properly and helps protect you from attacks.
If you call the emergency services, we’ll give them information about you and where you are so they can help. We do this because it is necessary to protect you, or another person, and because it is in our interests to help the emergency services in providing help to you.
We might have to release personal information about you to meet our legal and regulatory obligations.
Under investigatory powers legislation, we might have to share personal information about you to government and law-enforcement agencies, such as the police, to help detect and stop crime, prosecute offenders and protect national security. They might ask for the following details.
The balance between privacy and investigatory powers is challenging. We share your personal information when the law says we have to, but we have strong oversight of what we do and get expert advice to make sure we’re doing the right thing to protect your right to privacy. You can read more about our approach to investigatory powers in our report on Privacy and free expression in UK communications (https://www.btplc.com/Thegroup/Ourcompany/Ourvalues/Privacyandfreeexpression/index.htm) And you can see the terms of reference for our oversight body here - https://www.btplc.com/Thegroup/Ourcompany/Theboard/Boardcommittees/InvestigatoryPowers/index.htm.
We’ll also share personal information about you where we have to legally share it with another person. That might be when a law says we have to share that information or because of a court order.
In limited circumstances, we may also share your information with other public authorities, even if we do not have to. However, we would need to be satisfied that a request for information is lawful and proportionate (in other words, appropriate to the request). And we would need appropriate assurances about security and how the information is used and how long it is kept.
We’ll also use your call, browser (including IP address) and TV records to find the best way of routing your communications through the various parts of our network, equipment and systems as required by our regulator.
If you order a phone service, we’ll ask if you want your details included in our directory services such as our Phone Book. If you do, we’ll publish your details and share that information with other providers of directory services. Ex-directory numbers aren’t included and will not appear in The Phone Book.
We share your personal information with other companies within the BT Group. We have a group-wide arrangement, known as binding corporate rules, to make sure your personal information is protected, no matter which company in the BT Group holds that information. You can ask for a copy of our binding corporate rules by emailing our data protection office, contact details can be found here.
We also use other service providers to process personal information on our behalf. Details of how they handle your personal information are set out below.
We use other providers to carry out services on our behalf or to help us provide services to you. We also use them to:
Where we use another organisation, we still control your personal information. And we have strict controls in place to make sure it’s properly protected.
Finally, the section above describes the situations in which your personal information is shared to other organisations, government bodies and law-enforcement agencies. When we share your information with other organisations we’ll make sure it’s protected, as far as is reasonably possible.
If there’s a change (or expected change) in who owns us or any of our assets, we might share personal information to the new (or prospective) owner. If we do, they’ll have to keep it confidential.
For more details, or if you’d like a copy of our binding corporate rules or other information about a specific transfer of your personal information, get in touch with .our data-protection officer by email firstname.lastname@example.org The fraud prevention section above provides details on transfers fraud prevention agencies may carry out.
We have strict security measures to protect your personal information. We check your identity when you get in touch with us, and we follow our security procedures and apply suitable technical measures, such as encryption, to protect your information.
In other cases we’ll store personal information for the periods needed for the purposes for which the information was collected or for which it is to be further processed. And sometimes we’ll keep it for longer if we need to by law. Otherwise we delete it.
You can get in touch with our data-protection officer by email email@example.com or write to the address below and mark it for their attention.
11440 Commerce Park Drive, Suite 100
Reston, VA 20191
If you want to make a complaint on how we have handled your personal information, please contact our data protection officer who will investigate the matter and report back to you. If you are still not satisfied after our response or believe we are not using your personal information in line with the law, you also have the right to complain to the data-protection regulator in the country where you live or work. For the UK, that’s the Information Commissioner - https://ico.org.uk/.
We have included a description of how the technical terms we use are generally interpreted.
Tags are an instruction inserted on a website that specifies how the site, or a part of the site, should be formatted and how it’s performing.