We aim to make our website as accessible as possible. However if you use a screen reader and require debt advice you may find it easier to phone us instead. Our phone number is 0 8 0 0 1 3 8 1 1 1 1. Freephone (including all mobiles).

Our privacy notice for website users

Making it clear how we manage cookies and your information

Manage your cookie preferences

Quickly find what you are looking for

  1. About our privacy notice
  2. Who is responsible for your personal data?
  3. What personal data do we collect, how do we use it, and where do we collect it from?
  4. When do we use automatic decision making?
  5. Who do we share your personal data with and why?
  6. How long will we keep your personal data for?
  7. How do we keep your personal data secure?
  8. Will we transfer any of your personal data outside of the UK?
  9. What are your data protection rights?
  10. How can you complain about how we use your personal data?
  11. How will we tell you about any changes in how your personal data is used?
  12. Manage your cookie preferences

1. About our privacy notice

This notice is for users of our website services whose information we may collect as part of our online activities.

This is someone who:

  • Has visited our website
  • Has used one of our online tools, including our online debt advice service

We recognise that individuals whose information we collect for these purposes may or may not be a StepChange client.

If you are a client of StepChange you should also read our Client Privacy Notice.

This notice tells you, as a user of our website services:

  • What personal data we hold about you
  • How and why we use your personal data
  • What your legal rights are

We recommend you read this notice to understand your data protection rights and how to manage them.

'Personal data' means any information that:

  • Is about you
  • And which can be used to find out who you are

In some cases this data could be more sensitive. It may be data that is private to you. Find out more in Section 3.

We do not offer products or services to children.

Our website services use cookies

Cookies are small data files that are sent to your browser. We use them to:

  • Keep our websites safe: Such as, to check you are a real person and not a bot
  • Collect information about how people find and use our websites to optimise the user experience: Such as, to learn how you found our website and what you were searching for
  • Publish content provided by third parties: Such as our videos and online forms which are hosted on other websites
  • Remember your user preferences: Such as, if you change the language settings

More information about how we use cookies

This privacy notice relates to:

  • embed.stepchange.org
  • moneyhealthcheck.stepchange.org
  • start.stepchange.org
  • advice.stepchange.org
  • security.stepchange.org
  • jobs.stepchange.org
  • onlinedmp.stepchange.org
  • www.stepchange.org

2. Who is responsible for your personal data?

Our website is run by StepChange which is made up of three companies. Find out more about them:

Trading as StepChange Debt Charity and StepChange Debt Charity Scotland

Registered Office:
123 Albion Street
Leeds
LS2 8ER

  • Registered In England no. 2757055
  • Registered charity in England and Wales: 1016630, Scotland: SC046263.
  • Authorised and regulated by the Financial Conduct Authority.
  • ICO registration No. Z743192X

Trading as StepChange Voluntary Arrangements

  • Registered Office as above
  • Registered in England no. 5659160
  • ICO registration No. Z9690343

Trading as StepChange Financial Solutions

  • Registered Office as above
  • Registered in England no. 6741879
  • ICO registration No. Z1721238

These companies are all known as 'Data Controllers'. As a Group, this means we are responsible for deciding:

  • Why we collect data about you
  • What data we collect
  • How we use your personal data
  • How we store your personal data

By law, we have to tell you this and make this privacy notice available to you.

To provide our services, we may need to share data across our Group. Colleagues only have access to the data they need to do their job. We have controls in place to ensure this.

Our Data Protection Officer checks we are meeting the law and standards across the group. Their contact details have been included in Section 9.

3. What personal data do we collect, how do we use it, and where do we collect it from?

We will collect personal data from you when you use our website to access our online services. This could be when:

  • You get debt advice
  • Update the details of your plan
  • Apply for a job with us

To find out more about how we use your personal data, read the privacy notice that fits your relationship with us.

Our privacy notices

You may see online forms on some pages of our website. We use these so you can keep in touch with us to:

  • Find out more about our policy campaign work
  • Attend an event
  • Order marketing assets
  • Become a partner
  • Make a general enquiry

What personal data we collect will vary depending on the form or survey. Often this will include:

  • Your name
  • Contact details
  • Details about your personal circumstances

To find out more about how we use your personal data, read the privacy notice that fits your relationship with us.

Our privacy notices

Like most websites we use 'cookies' and similar tools. Cookies are small pieces of text sent to the device you use to visit the website. They are used in different ways.

On our website we group our cookies into:

Necessary cookies:

We use these to:

  • Make our website work
  • Make our website perform better
  • Make our website secure

These cookies are automatically placed when you use our website. This means you cannot reject them. We do this as we have a legitimate interest to maintain and secure our website.

Optional cookies:

These are cookies which we use to:

  • Help us understand our web visitors
  • Help us advertise our services
  • Remember your preferences from when you last used our website

We ask you to consent to us placing these optional cookies on your device. We do this through the pop-up banner which appears when you first visit our website. You can choose to:

  • Accept all these cookies
  • Decline these cookies
  • Choose which types of cookies you are happy for us to use

Please be aware that some features of our website may not work as expected without the use of these cookies. Such as, an online form or video may not show on the page. You can change your preferences for these optional cookies at any time.

  • Click on 'Change your consent' or 'Withdraw your consent'
  • Choose to 'Decline', 'Continue with Selected' or 'Accept all'
  • Use the sliders for each type of cookie to switch them on an off

Click here to manage your cookie preferences

4. When do we use automatic decision making?

We make use of automated tools on our website to:

  • Detect suspicious activities
  • Block suspected malicious intent

We do this to ensure our website remains secure and can be accessed by those who need it.

We also use algorithms as part of our debt advice services and to analyse our interactions. Please read our client privacy notice for more information about this.

5. Who do we share your personal data with and why?

There are times when why we might share your personal data with other organisations through the website.

Find out who we share your personal data with and why by clicking the links below.

We sometimes may need to share your personal data with other organisations:

  • Where we have a legitimate business reason
  • Where we have to by law
  • To meet the terms of a contract
  • Where you have told us we can do this

Who we may share personal data with and why:

  • Government departments and agencies: Where we must share personal data by law. Such as HM Revenue and Customs (HMRC), HM Treasury, and the Department of Work and Pensions (DWP)
  • Regulators: Where we must share personal data by law. These include the Charity Commission, the Financial Conduct Authority (FCA), Insolvency Practitioners Association (IPA), and the Information Commissioner’s Office (ICO)
  • Law enforcement agencies: Where we need to report a crime. Also to help them detect, investigate and prevent crime
  • Legal professionals, Courts of Law and other parties: Where information is needed for legal claims and proceedings
  • Auditors: Where we have to be audited by law. These are called 'statutory audits'
  • Our insurers
  • Our accountants, legal, and compliance advisers. As well as other specialist consultants or contractors

We may also share your personal data if you have asked us to or told us we can.

We will keep records of what has been shared with third parties and why.

We also work with third party suppliers who help to deliver our services.

Our suppliers will only have access to your personal data where we have given them strict instructions and have first made sure that your personal data is secure when it is with them.

We use them for:

  • IT services, software, and hardware
  • Helping us to manage cookies on our website
  • Ensuring our website remains secure and safe to use

There may be other examples.

We may share 'statistical data':

  • Internally within our organisation
  • With Charity partners and funders
  • The wider public to support our campaign work

In these cases, you will not be able to be identified. For example, we may share or publish details about the challenges our clients face as part of our reporting on the reasons why people have financial difficulty.

6. How long will we keep your personal data for?

When using our website to access our services

We keep your personal data in line with our retention schedule.

Please read the privacy notice which applies to your relationship with us.

For personal data collected through cookies

Read about our cookies to find out how long we keep your personal data for when we use cookies.

There are different types of cookies:

  • Session cookies: These are temporary cookies. They are always deleted when you close your browser
  • Persistent cookies: These cookies stay on your computer for a set period. Or until you manually clear your browsing data
  • First and third-party cookies: First-party cookies are set by the same website as you are on at the moment. Third-party cookies are set by another domain or web address

7. How do we keep your personal data secure?

We take appropriate technical and organisational measures to make sure that the data we hold is safe and secure.

We only allow your personal data to be used by individuals who need it to carry out their job. All our employees and contractors are subject to confidentiality rules.

We regularly review our security controls and monitor for security breaches. We have processes in place to handle security breaches if they do happen.

8. Will we transfer any of your personal data outside of the UK?

We may need to do this from time to time. For example, if a supplier stores data in another country.

But we will only do this if:

  • That country meets data protection standards, as laid out by UK law. Such as, countries in the European Economic Area. Or,
  • We, or one of our third-party data processors, have entered into a contract with an organisation outside of the UK, on terms approved by the UK's data protection regulator. We also have assessed that country's laws. Or,
  • You have clearly asked us to share your personal data with an organisation outside of the UK and we have explained the risks of doing so to you

9. What are your data protection rights?

You have a number of rights relating to how we use your personal data. They depend on why we are using your personal data. We have listed these below.

Please contact us at DPO@stepchange.org and we will respond.

We may need you to share extra detail so we can:

  • Check who you are
  • Establish your relationship with us or one of our clients
  • Understand what you need from us
  • Ask for additional forms of identification, as we will not usually have a relationship with you

In most cases, we will respond within one calendar month. If there is a reason why it is taking us longer, we will let you know.

  • To have access to this notice
  • To get a copy of this notice
  • To get copies of the information we hold about you
  • To confirm how we use or have used your personal data
  • To find out how long we will continue to store your personal data
  • To update any information that is wrong, incomplete, or out of date
  • To delete or destroy data we hold about you
  • To restrict the use of your personal data
  • To ask us to transfer your personal data to another organisation
  • To object to how we use your personal data
  • To take away any consent you have given us before
  • To ask for a human review where a decision has been made using a computer

There can be exemptions or restrictions for all of the above rights. This could mean we may not be able to do as you have asked. We will let you know if this is the case.

10. How can you complain about how we use your personal data?

If you are unhappy with how we have used your data there is a process you can follow.

If you are unhappy with:

  • How we have used or handled your personal data or
  • How we have handled your data protection rights request

Please follow our client complaints process.

Email: customerrelations@stepchange.org

If you are unhappy with how a data protection complaint was handled, email DPO@stepchange.org

You may also raise this with the Information Commissioner’s Office. (ICO) They are the UK’s Data Protection regulator. Visit their website to find out more about this.

Please note: The ICO expect you to have gone through our internal complaints process before raising a complaint with them.

11. How will we tell you about any changes in how your personal data is used?

We reserve the right to update this privacy notice at any time.

We may also tell you in other ways, from time to time, about how we use your personal data.

We will only use your personal data for the reasons why we collected it, unless:

  • We reasonably think we need to use it for another reason, and
  • That reason is compatible with the original purpose

If we need to use your personal data for a new reason, we will let you know. We will explain at this point why we are allowed to do this by law.

12. Manage your cookie preferences

About different types of cookies

  • Session cookies: These are temporary cookies. They are always deleted when you close your browser
  • Persistent cookies: These cookies stay on your computer for a set period. Or until you manually clear your browsing data
  • First and third-party cookies: First-party cookies are set by the same website as you are on at the moment. Third-party cookies are set by another domain or web address

We may link to other websites owned and operated by certain trusted third parties to make you aware of:

  • Additional products
  • Information and services

These other third-party websites may also use cookies or similar technologies in accordance with their own separate policies. For privacy information relating to these other third-party websites, please consult their policies as appropriate.