Live Chat
ARB Privacy Notice
1. Introduction
The Architects Registration Board (“ARB”, we” or “us“) take the privacy of your information very seriously. This notice explains who we are, how we collect, share and use personal data about you and how you can exercise your privacy rights. Please read this notice carefully and in full to ensure you are completely informed about your personal data.
This notice applies to all personal data processed by ARB. Because different ARB services and activities involve different types of processing, additional information is provided in processing-specific tables linked below. These tables form part of this notice and should be read alongside it. They provide more detailed information about the categories of personal data processed, the purposes of processing and the legal bases relied upon for particular services, systems and activities, particularly our:
2. Contact details and data controller
If you have any queries about this notice, please get in touch with us and we will do our best to answer your questions.
ARB is the data controller of the personal data processed in connection with the activities described in this notice.
For the purposes of the UK General Data Protection Regulations (“UK GDPR“) and the Data Protection Act 2018, the data controller is the Architects Registration Board of 5th floor, 70 Gray’s Inn Road, London, WC1X 8NH, which is registered with the ICO with registration number Z7544933.
3. Who is ARB and what do we do?
ARB is an independent professional regulator established by Parliament as a statutory body, formed pursuant to and subject to the powers contained in the Architects Act 1997. We are located in the UK. We regulate the architects’ profession in the UK by ensuring only those who are suitably competent are allowed to practise as architects, by maintaining a publicly available Register of Architects, setting the standards of conduct and practice, setting requirements for and monitoring continuous professional development and protecting the legally protected title “architect”.
For more information about ARB, please visit the “About ARB” page.
4. Personal data collected and processed
Information you provide directly
We collect personal data directly from you when you provide it to us through our Website, CRM Portal, Complaints Portal, by email, telephone, post or through other communications with us.
This may include:
-
your name, date of birth, postal address, email address, telephone number and other contact details;
-
account information, including usernames, passwords and login credentials;
-
information contained in forms, applications, supporting documents and other materials that you submit to us, including applications for registration, retention on the Register, accreditation, appointments or employment opportunities;
-
information provided when downloading, requesting or purchasing copies of the Register of Architects or other ARB publications;
-
information relating to an allegation of unacceptable professional conduct, serious professional incompetence or an alleged breach of section 20 of the Architects Act 1997;
-
information contained in correspondence between you and ARB, including enquiries, complaints and feedback;
-
information you provide when reporting a problem with our Website, CRM Portal, Complaints Portal or other services;
-
responses to surveys, consultations, questionnaires or research activities that support ARB’s statutory functions; and
-
any other personal data you choose to provide to us.
Information collected automatically
When you use our Website, CRM Portal or Complaints Portal, we may automatically collect certain information about your device and how you use our services.
This may include:
- technical information such as IP address, browser type, operating system and device information;
- information about your visits to our Website, CRM Portal and Complaints Portal, including pages visited, resources accessed and interactions with our services; and
- information collected through cookies and similar technologies. Further information is available in our Cookies Notice.
Information relating to payments and transactions
Where you make a payment to ARB, purchase a product or service, or pay a fee in connection with an application or registration, we may collect information necessary to process that transaction.
This may include:
- billing and payment information;
- transaction and payment records; and
- limited financial information, such as bank account details or payment card information, where required to process a payment.
Information obtained from third parties
We may also obtain personal data from third parties where this is necessary for our statutory functions, regulatory activities, operational requirements or other lawful purposes.
This may include information obtained from:
- educational institutions, professional bodies, regulators and government departments;
- complainants, witnesses, referees or other individuals providing information relevant to ARB’s regulatory functions;
- service providers that support our operations, including IT, hosting, communication, payment processing, analytics and customer relationship management services; and
- publicly available sources and social media platforms where relevant and lawful to do so.
Where we receive personal data from third parties, we will take reasonable steps to ensure that the information has been obtained and disclosed lawfully.
When provision of personal data is required
In some circumstances, you are not legally required to provide personal data to us. However, where personal data is necessary for us to carry out our statutory functions or provide a service, we may be unable to process an application, consider a request, investigate a complaint, maintain registration records or otherwise provide the relevant service if the information is not provided.
5. How we use your personal data and legal basis for processing it
We use the personal data that we collect from and about you only for the purposes described in this notice or for purposes that we explain to you at the time we collect your information. Depending on our purpose for collecting your information, we rely on one of the following legal bases:
Consent: in certain circumstances, we may ask for your consent to the processing of your personal data for one or more specific purposes, in which case you can voluntarily choose to give or deny your consent without any negative consequences to you;
Contract: this would be where processing is necessary for the performance of a contract to which you are party or in order to take steps at your request prior to entering into a contract;
Legal obligation: there are instances where we must process and retain your personal data to comply with a legal obligation to which we are subject, particularly in the exercise of our official authority to deliver the provisions of the Architects Act 1997;
Public task: this would be where processing is necessary for the performance of a task carried out in the public interest or in the exercise of our official authority to deliver the provisions of the Architects Act 1997;
Legitimate Interests: we will use or disclose your personal data for the legitimate interests of either ARB or a third party, but only when we are confident that your privacy rights will remain appropriately protected. If we rely on our (or a third party’s) legitimate interests, these interests will normally be to: operate, provide and improve our organisation, including our Website, CRM Portal and/or Complaints Portal; communicate with you and respond to your questions; improve our Website, CRM Portal and/or Complaints Portal or use the insights to improve or develop marketing activities and promote our products and services; detect or prevent illegal activities (for example, fraud); and/or to manage the security of our IT infrastructure, and the safety and security of our employees, customers, vendors and visitors. Where we require your data to pursue our legitimate interests or the legitimate interests of a third party, it will be in a way which is reasonable for you to expect as part of the running of our organisation and which does not materially affect your rights and freedoms.
6. Your rights
UK GDPR affords you with rights, which are summarised below. In order to assert any of these rights, you may contact the Data Protection Officer using the details at the top of this notice.
- Right of confirmation – you have the right to obtain confirmation as to whether your personal data is being processed.
- Right of access – you have the right to obtain information about the personal data we hold about you, including information about how it is used, and where applicable, transferred, and to receive a copy of that information.
- Right to rectification – you have the right to have inaccurate personal data corrected and incomplete personal data completed.
- Right to erasure – you have the right to have your personal data erased where one of the statutory grounds applies, and there is no overriding reason for us to continue processing it.
- Right to restrict processing – you have the right to request that we restrict the processing of your personal data where a statutory reason applies.
- Right to data portability – where applicable, you have the right to receive personal data that you have provided to us in a structured, commonly used and machine-readable format and to request that it is transferred to another controller.
- Right to object – you have the right to object to our processing of your personal data in certain circumstances, including where we rely on legitimate interests or process personal data for direct marketing purposes.
- Right to withdraw consent – where the basis of our processing your personal data is consent, you have the right to withdraw that consent at any time. Withdrawal of consent will not affect the lawfulness of processing carried out before consent was withdrawn.
- Right to complain – you have the right to complain to us about our use of your personal data. We encourage you to contact us first so that we can try to resolve your concerns. You also have the right to complain to the Information Commissioner’s Office (ICO) about our processing of your personal data. The contact details for the ICO are available on their website.
We will respond to requests made in connection with these rights in accordance with applicable data protection law.
7. Sharing your personal data
Where necessary or required we share personal data with third parties. Examples of this include:
- Third-party service providers and partners who process personal data on our behalf, including providers of payment processing, information technology, hosting, communications, analytics, customer relationship management and other services that support ARB in carrying out its statutory functions;
- A third-party or successor organisation in connection with any actual or proposed transfer, restructuring or succession relating to ARB’s statutory functions or powers;
- Third parties to whom we have delegated certain functions or activities, including communicating with you and providing statutory notifications, regulatory services and other support services on our behalf;
- Third party providers who assist us in delivering essential communications and other operational services;
- Law enforcement agencies, regulators, government bodies, courts, tribunals, professional advisers and other third parties where we consider disclosure necessary to comply with a legal obligation, exercise or defend legal rights, carry out our statutory functions, prevent or detect crime or fraud, or otherwise protect the rights, property or safety of ARB or others;
- Third-party organisations to allow them to maintain accurate records in respect of the title ‘architect’, where we consider it would be in the public interest to do so;
- Third parties where disclosure is necessary to protect the rights, property, or safety of ARB, users of our Website, CRM Portal or Complaints Portal, or others. This may include exchanging information for the purposes of fraud protection, credit risk reduction and information security;
- Contracted service providers engaged to assist us in the delivery of our statutory obligations under the Architects Act 1997, including legal advisers and professional service providers;
- Third-party information technology and data hosting providers that support our systems and data storage services;
- Current, past or prospective employers where necessary in connection with ARB’s regulatory functions or the provision of its services; and
- Any other person or organisation where you have given your consent to the disclosure.
Where we share personal data with a processor acting on our behalf, we ensure that appropriate contractual and security measures are in place. Processors are only permitted to process personal data on our instructions, must keep it secure and may only use if for the agreed purposes.
8. Retention of data
Personal data will only be retained where we have an ongoing legitimate purpose for its retention, as defined by ARB’s retention and destruction policy (available upon request). After the expiration of that period, the data will be securely deleted.
9. Information automatically collected from your computer (cookies and similar tracking technologies)
We use cookies and similar tracking technology (collectively, “Cookies”) to collect and use personal data about you. For further information about the types of Cookies we use, why, and how you can control Cookies, please see our Cookie Notice.
10. How we keep your personal data secure
We use appropriate technical and organisational measures to protect the personal data that we collect and process about you. The measures are designed to provide a level of security appropriate to the risk of processing. Specific measures we use include – encrypting your personal data in transit and at rest; using an industry standard framework as part of any Information Security programme; employing advance malware protections; implementation of other reasonable security defences (including vulnerability management, access management and recovery/resilience measures).
11. Use of technology including AI
ARB uses certain technology tools, including AI-assisted tools, to support some administrative and regulatory processes. AI tools are not used by ARB to make decisions about individuals without meaningful human involvement. Where AI tools are used, they are used to assist ARB staff, who remain responsible for reviewing information and making any final decisions.
12. Transferring your information outside of the UK
In some cases, where your personal data is transferred to third parties, it is processed outside of the UK. These countries may have data protection laws that are different to the laws of your country (and, in some cases, may not be as protective).
Where we transfer your personal data to countries or organisations outside of the UK, which have been formally recognised as providing an adequate level of protection for personal data, we rely on the relevant “adequacy regulations” (data bridges) from the Secretary of State in the UK.
Where the transfer is not subject to an adequacy decision or regulations, we have taken appropriate safeguards to ensure that your personal data will remain protected in accordance with this notice and applicable laws. The safeguards we use to transfer personal data are in case of our third party service providers and partners are the European Commission’s Standard Contractual Clauses as issued on 4 June 2021 under Article 46(2) including the UK Addendum or the UK International Data Transfer Agreement permitted under Article 46(2) of the UK GDPR for the transfer of data originating in the UK.
Our Standard Contractual Clauses or the UK International Data Transfer Agreements entered into with our third party service providers and partners can be provided on request.
13. Changes to our privacy notice
We may update this notice from time to time in response to changing legal, regulatory, technical or organisation developments. When we update our notice, we will take appropriate measures to inform you, consistent with the significance of the changes we make. These measures may be to notify you by e-mail.