DATA PROTECTION NOTICE - UPDATED 3rd April 2025

The Institute of Bankers in Ireland (trading as IOB) takes privacy and the protection of our customer, affiliate, member, student and designate data very seriously. In this notice, we explain how we collect your personal information, how we use it and how you can interact with us about it.

Who are we?

When we talk about “IOB”, or “us” or “we” in this notice, we are talking about IOB.

Data Protection Officer

Our Data Protection Officer oversees how we collect, use, share and protect your information to ensure your rights are fulfilled. You may contact our Data Protection Officer at [email protected] or by writing to: Data Protection Officer, IOB, 47-49 Pearse Street, Dublin 2.

How we collect information about you

We collect personal information from you, for example when you become a member; or a customer in order to create an account on IOB Learn; register to an educational programme; apply for information on our products and services; apply for a designation/CPD scheme or express an interest in one of our programmes or a programme offered in association with one of our educational partners. We also collect information through our websites, web-conferencing, social media, the IOB Learn application, CCTV footage and through communication between you and IOB by telephone, email and chat (for example, when you call to make enquiries about a course or when you are raising concerns or queries). We will sometimes record phone conversations and we will always let you know when we do this.   We may also obtain your personal data from third parties, for example:  

• Information provided by your employer or representative acting on your behalf 

• Information from or required from a funding body (e.g. Springboard, IFS Skillnet) 

• Information about you provided by referees you have nominated 

• Issuing authorities of documents you have submitted as proof of qualifications (e.g. verification of your degree by your previous university) 

Some of our educational partners are "joint" data controllers with IOB (e.g. UCD, the Compliance Institute, the Central Bank of Ireland) in the delivery of specific educational and designation services which we provide to you. This means that IOB, together with these "joint" controllers, make decisions in respect of the information about you which we process.   Our websites use ‘cookie’ technology. A cookie is a little piece of text that our server places on your device when you visit any of our websites or applications. They help us make the sites work better for you. When you apply to us for products and services and during the time you avail of these, we may verify your identity. We may do this by sending and receiving information about you, to and from third parties including your employer.

Cookie technology is also used on the Chat & Help Centre application by Intercom, which operates the Chat & Help Centre application on our behalf. Intercom is responsible for cookies on Chat & Help Centre and you may consult the cookies policy on www.intercom.com for further details.

Information we collect about you 

IOB collects personal data relating to you in order to provide our services to you. 

The types of personal data processed by IOB may include (depending on the context of the service being provided to you) but are not limited to: 

• Customer number – generated when an IOB account is created for you 

• Unique personal identifiers and biographical Information, such as student number, name, title, date of birth, country of birth, nationality 

• Your contact details including residential and employer addresses, mobile phone number, email address(es) 

• PPS number 

• Employer details 

• Details of previous examination results and qualifications awarded 

• Schools/colleges attendance records 

• Bank details, including IBAN, BIC, Name of bank/building society 

• Credit card details (processed by our payment provider) 

• Information to provide student support services such as career guidance, where applicable 

• Image in digital photograph for ID cards 

• Image as part of online examination/assessment processes as part of online invigilation  

IOB may in some cases process “special category data”, for example, health data, where relevant to applications for support, extenuating circumstances relating to examinations or pro-rata adjustments relating to designations, disability information (for example, where needed for the provision of student support services). 

How we keep your information safe

We use technical and organisational measures to protect your personal information from unauthorised access, to maintain data accuracy and to help ensure the appropriate use of your personal information. These security measures include encryption of your personal information, firewalls, intrusion detection systems, 24/7 physical protection of facilities where your personal information is stored, background checks for personnel that access physical facilities, and strong security procedures across all service operations. We use strong encryption algorithms for the transmission and storage of your information. When you contact us to ask about your information, we may ask you to identify yourself. This is to help protect your information.

How long we keep your information for

How long we hold your information depends on the nature of the information and the purposes for which it is processed. We determine appropriate retention periods which meet our academic, legal and regulatory obligations. We hold your information while you are a member, affiliate member, customer, student or designate and for a period of time after that. We do not hold it for longer than necessary. If the purpose for which the information was obtained has ceased and the personal information is no longer required, the personal data will be deleted or anonymised (i.e. all identifying characteristics are removed).

Meeting our academic, legal and regulatory obligations

To meet our academic, regulatory and legal obligations, we collect some of your personal information, verify it, keep it up-to-date through regular checks, and delete it once we no longer have to keep it. We may also gather information about you from third parties to help us meet our obligations. If you do not provide the information we need, or help us keep it up-to-date, we may not be able to provide you with our products and services.

To use your information lawfully, we rely on one or more of the following legal bases:

• your consent;

• necessary for the performance of a contract with you;

• necessary for compliance with a legal obligation (e.g. "Minimum Competency Code", "Fitness & Probity", Universities Act 1997);

• necessary to protect the vital interests of you or others;

• necessary for the performance of a task carried out in the public interest; or

• necessary for the purposes of our legitimate interests, including to pursue our goals and promote our services, or the legitimate interests of a third party (e.g. your employer). We will not process your personal data for these purposes if to do so would constitute an unwarranted interference with your own interests, rights and freedoms.

Consent

Sometimes we need your explicit consent to use your personal information. When we use sensitive personal information about you, such as health data, for example when you request a maternity leave pro-rata adjustment, we may ask for your consent. Before you give your consent, we tell you what information we collect and what we use it for. You can withdraw your consent at any time by contacting us.

Automated Decision-Making

Examinations are marked by human markers who access exam scripts and mark the questions according to the marking standard specified by IOB. The online invigilation system will flag activities that could indicate suspected non-conformance with Examination Regulations. However, no automated decisions will be made based on these flags. IOB uses Multiple Choice Questions (MCQs) for some assessments. These questions are marked using automated software against an answer key which is developed by the Examiner. The evaluation methods are regularly reviewed and tested to ensure they remain fair, effective and unbiased. As part of our Quality Assurance (QA), the questions are reviewed by an external examiner for accuracy and fairness. You may ask us not to make decisions about you that are based solely on automated processing.

Direct Marketing

We would like to make you aware of products and services which may be of interest to you. We may do this by phone, post, email, text or through other digital media. You can decide how much direct marketing you want to accept when you apply for new products and services. You can make changes to your marketing preferences at any time via "Quick Links > My Details" section on IOB Learn or by contacting us directly at: Phone: + 353 1 6116500, Email: [email protected]

How we use your information

We use information about you to:

• process and administer your membership, programme registrations and designations/CPD;

• create your account on IOB Learn, add you to channels we think will be of interest to you, send you notifications via IOB Learn (if notifications are enabled) and otherwise facilitate your use of IOB Learn in accordance with our Terms and Conditions (available here: https://iob.ie/terms);

• organise events, conferences and webinars;

• track your professional development in respect of your stated professional goals;

• give you access to on-going learning and networking opportunities including career support;

• ensure we provide you with the best service possible, including customer support for any technical issues you may experience accessing our websites or IOB Learn;

• manage your fees;

• administer the relationship with any of your funders or sponsors; 

• administer assessment processes , specifically online processes;  

• provide other operational supports;

• provide and promote information on our membership, education, designation and continuing professional development services;

• safeguard and promote the welfare of members;

• carry out surveys and statistical analysis;

• respond to your enquiries or complaints;

• confirm details relating to you to your employer, where they have a legitimate interest in providing or receiving those details;

• confirming details relating to you to other professional education partners or professional standards bodies (e.g. European Financial Planning Association (EFPA)), where there is a legitimate interest in sending those details;

• provide reference requests subject to your consent;

• tailor communications to make them relevant to any preferences that you have demonstrated;

• prevent unauthorised access to your information;

• meet our legal and regulatory obligations;

• establishing, exercising or defending legal claims; and

• identify ways we can improve our products and services to you.

To provide our products and services under the terms and conditions we agree between us, we need to collect and use personal information about you. If you do not provide this personal information, we may not be able to provide you with our products and services.

Your information and third parties

Sometimes we process and share your information with trusted third parties. For example, we share information with:

• service providers (e.g. assessment facilitators, printers, auditors, legal advisors and other professional advisors);

• educational and funding partners (e.g. UCD, Higher Education Authority (HEA), IFS Skillnet, The Central Bank of Ireland) or professional standards bodies (e.g. EFPA);

• employers (e.g. to confirm details regarding designations, CPD schemes or programme participation, or to inform your employer where a designation is removed including due to membership default or resignation);

• other legal and regulatory bodies (e.g. The Central Bank of Ireland);

• Information and Communications Technology (ICT) and information security providers.

We may also share information with third parties to meet any applicable law, regulation or lawful request, including with law enforcement agencies, which may be either in or outside Ireland or to deal with any claim or dispute that may arise.

We expect these third parties to have the same levels of information protection that we have. In some cases we share information via systems that we control and where we do this, we require the third party recipients to comply with appropriate terms and conditions that govern access to those systems.

Your personal information rights

When your personal information is handled by IOB in relation to a product or service, you are entitled to rely on a number of rights. These rights allow you to exercise control over the way in which your personal information is processed, subject to applicable exemptions.

For example, we may help you in:

Accessing your personal information: You can ask us for a copy of the personal information we hold about you.

Correcting and Updating your personal information: If you believe that any personal information we hold about you is inaccurate or out of date, you can look for the information to be corrected at any time.

Withdrawing consent: You can change your mind wherever you give us your consent, such as for direct marketing, or using your sensitive information, such as medical or biometric data.

Restricting our use of your personal information: You have the right to restrict our use of your personal information in certain circumstances, such as where our use of it is not compliant with applicable law.

Objecting to our use of your personal information: You have the right to object to us using your personal information, where we are doing so based on this being necessary for the performance of a task carried out in the public interest or for the purposes of a legitimate interest. Where you exercise this right to object, we will be obliged to stop using your personal information in that way, unless there are compelling legitimate grounds for us to continue to do so, despite your objection.

Not to be subject to automated decision making: You have a right (subject to limited exceptions) not to be subject to a decision based solely on automated processing of information, including profiling, which produced significant legal effects concerning you or otherwise significantly affects you.

Deleting your information (your right to be forgotten): You may ask us to delete your personal information.

Moving your information in electronic form (your right to Portability): You may request (in certain cases) that your personal information is transferred to you or another organisation in digital form.

How to exercise your rights

You may execute any of these rights free of charge. You may do so by contacting us:

Phone: + 353 1 6116500 Email: [email protected]

When you contact us to ask about your information, we may ask you to identify yourself. This is to help protect your information. Once we are satisfied that we have effectively verified your identity, we will respond to the majority of requests without undue delay and within a one month period (i.e. 30 calendar days) of receipt of the request. IOB will action your request to have your personal information corrected within 10 calendar days. These periods may be extended in exceptional circumstances and we will inform you where the extended period applies to you along with an explanation of the reasons for the extension.

International transfers of data

We sometimes need to share your information with organisations which are located or who undertake processing outside the European Economic Area (EEA) to help us provide you with our products and services. Some educational programmes/partners, for example, are provided/located outside the EEA. This may mean that some personal information may be processed in countries such as India, Singapore or the United States. We expect the same standard of data protection is applied outside of the EEA to these transfers and the use of the information, to ensure your rights are protected and will only transfer personal information to a country or territory outside of the EEA: (a) if that country provides an adequate level of protection for personal information as set down by the European Commission or (b) where the transfer is made under a legally binding agreement which covers the EU requirements for the transfer of personal information to recipients outside of the EEA, such as the model contractual clauses approved for this purpose by the European Commission, or (c) where there is an alternative basis for engaging in the transfer that is compliant with applicable laws. For more information about the European Commission’s decisions on the adequacy of the protection of personal information in countries outside the EEA, please visit: ec.europa.eu/info/law/lawtopic/data-protection_en.

Some providers (e.g., Google LLC) process data in the United States. Where a provider is certified under the EU‑US Data Privacy Framework (DPF), we rely on the DPF. Where not certified, we use Standard Contractual Clauses and conduct Transfer Impact Assessments with supplementary measures.

For more information about IOB’s arrangement regarding transfers of personal information outside EEA you can contact us by phone or email via the details set out below.  

Making a complaint

If you have a complaint about the use of your personal information, please let a member of staff know, giving them the opportunity to correct things as quickly as possible. If you wish to make a complaint you may do so in writing and by email [email protected]. Please be assured that all complaints received will be fully investigated. We ask that you supply as much information as possible to help our staff resolve your complaint quickly.

You may also contact the Data Protection Commission in Ireland to lodge a complaint (details below).

Data Protection Commission 21 Fitzwilliam South, Dublin 2, D02 RD28 Web: dataprotection.ie

Data Protection Policy

IOB, as a provider of Professional Education, CPD (Continuing Professional Development) and Membership Services to the financial services sector in Ireland and beyond, processes personal data for a variety of purposes relating to its members, employees, service providers and other third-parties involved with the organisation. IOB is therefore a data controller, and in some cases a data processor, and is subject to data protection legislation and regulation. IOB's Data Protection policy (available here) sets out data protection requirements which must be complied with by anyone who processes personal data for or on behalf of IOB.

Updates to this notice and policy

We keep this notice and policy under regular review and will make changes from time-to-time, particularly when we change how we use your information, and change our technology and products or services. We will inform you of material changes to the contents of this Data Protection Notice, through a notification posted on our website or through other communication channels.