Last updated: 12 August 2026
This Privacy Policy:
- Describes how we gather and protect individually identifiable information.
- Describes how we use, process, transfer and share personal information and,
- Sets out your rights in relation to your information and who you can contact for more information or queries.
Please read this Privacy Policy carefully. If you have any requests concerning your personal information or any queries with regard to our processing, please contact us at privacy@cfauk.org.
We may make changes to this Privacy Policy from time to time and any changes will be made available to you on our website or by other means.
Contents
This privacy policy consists of the sections set out below. Please click on the section below for ease of navigation.
- Who are we?
- How can you contact us?
- Changes to the privacy policy and your duty to inform us of changes
- How do we collect your personal data?
- What personal data do we collect?
- How do we process and use your personal data?
- Data accuracy and merging records
- What is the legal basis for processing your personal data?
- Who do we share your personal data with?
- Change of purpose
- International data transfers
- How long do we keep your personal data?
- How do we protect your personal data?
- What are your rights under the UK GDPR?
- Marketing and unsubscribing from marketing communications
Summary of Key Points
- By using the CFA UK website, CFA UK digital archive, or other CFA UK platforms (the ‘Site’ or ‘Sites’) or providing Personal Information to us, you consent to our processing and transfer of your Personal Information as we describe here.
- We collect Personal Information when you provide information to CFA UK through the Site or our Mobile Apps, when you sign up for CFA UK information through digital advertising, when you register for an exam or an event, or through other communications with CFA UK and CFA UK personnel. We use Personal Information to provide CFA UK products and services to you. [Learn more about the information that CFA UK collects and how we use it.]
- We transfer Personal Data to the United States and jurisdictions outside of the UK as necessary for the purposes described in this Policy, including to jurisdictions that may not provide the same level of data protection as your home country. [Learn more about international transfers].
- We share Personal Information with exam preparatory providers and other partners which provide products and services that may be of interest to you. We also share Personal Information that you post on our Social Media and Community Networking Sites.
- If you have an account with us, you can change your preferences for how we contact you and view your Personal Information on file with us at any time by visiting [Your Account].
- When we process your Personal Information based on your consent, you have a right to withdraw your consent. We also provide you additional rights to access, rectify, and erase your Personal Information, to obtain a portable copy of your Personal Information, and to restrict or object to our processing of your Personal Information. These rights are limited under the applicable UK data protection law. [Learn more about your data rights].
- We maintain reasonable and appropriate technical, physical, and administrative measures to protect the security of your Personal Information and access to Personal Information is limited. [Learn more about security]
- Our Site and Mobile Apps may have links to other sites that we do not control. Their privacy policies may differ from ours. We encourage you to read the privacy statement of any website you may visit.
- If we make any material changes to our privacy practices, we will post a prominent notice on our Site notifying users of the change.
CFA Society of the UK (‘CFA UK’) is a not-for-profit professional body for investment professionals with its registered office at 3rd Floor, Boston house, 63-64 New Broad Street, London, EC2M 1JJ. In this Privacy Policy, references to "we", "us" or "our" are references to CFA UK.
CFA UK is a data controller. This means we decide how and for what purposes your personal data is processed. The processing is governed by the UK GDPR and other applicable data protection laws.
CFA Institute is the global, not-for-profit professional body for the investment management profession and the awarding body of the CFA Program. CFA UK is affiliated with CFA Institute as its local member society for the UK. In this Privacy Policy, references to “CFA Institute” are to that organisation. CFA UK and CFA Institute share personal data with one another, in both directions, as described in this Privacy Policy.
Please contact privacy@cfauk.org if you have any questions relating to the privacy of your data. You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK regulator for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance.
If you wish to contact CFA UK, please do so via the Contact Us details shown on our website.
If you wish to make a subject access request, please do so via email to privacy@cfauk.org with ‘Subject Access Request’ in the title of the email.
If you have any questions or concerns about our use of your personal data, or would like to exercise one of your rights set out above, please contact us at privacy@cfauk.org.
If you are a data subject based in the EU, we are required by Article 27 of the EU GDPR to appoint a representative based within the EU for data subjects based within the EU to correspond with if you do not wish to contact us directly. The details of this representative are:
Prighter GDPR-Rep by Maetzler Rechtsanwalts GmbH & Co KG
c/o CFA Society of the UK
Address: Schellinggasse 3/10, 1010 Vienna, AUSTRIA https://prighter.com
We keep our privacy policy under regular review. This policy was last updated on 12 August 2026.
It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.
Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).
We collect your personal data both directly and indirectly. We collect your data directly when you:
- register for an examination
- purchase examination learning materials
- register, apply for, or renew your membership as a CFA UK member or as a CFA Institute member with CFA UK as your local society
- create an account on the CFA UK online portal
- register for events, courses, or online webinars
- apply for pre-employment verification, directly, via your company or via a screening agency
- register on CFA Institute’s ‘Careers Centre’
- use CFA UK’s online community platforms (‘Connect’) or other IT platforms
- join a special interest group or community
- use a mobile application associated with delivery of a CFA UK product or service
- register your interest in, or purchase, CFA UK’s products or services
- volunteer or apply to volunteer with CFA UK, including the CFA UK Board, join a CFA UK online community or sign up as a mentor or mentee, or use CFA UK social media channels
- respond to surveys, or speak to us via telephone, correspond with us by email or otherwise; and use our websites or Sites.
We may collect your personal data indirectly via our relationship with your employer, CFA Institute or third parties who may purchase products or services on your behalf, for example, training providers. We may also collect your personal data either directly, or via your employer, who may sponsor or be a customer of CFA UK’s to deliver products, events or other services.
We may collect, use, store and transfer different kinds of personal data about you which we have grouped together as follows:
- Identity Data includes first name, maiden name, last name, username or similar identifier, marital status, title, date of birth, gender (optional), employer, job role, training provider, country of registration and sitting (if you are an examination candidate), identification documents for verifying your name (if you are an examination candidate), and unique identification number(s) provided by the regulator or other professional bodies.
- Contact Data includes addresses, email addresses, and telephone numbers.
- Technical Data includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access this website.
- Profile Data includes your username and password, your interests, preferences, feedback and survey responses, details on your Charter, membership with CFA Institute (including your CPD record), examination results and assessment data, and history of qualifications held with us or another awarding body (in relation to an exemption application).
- Usage Data includes information about how you use our website and services. If you are a user of CFA UK’s online communities, learning platforms, websites, social media, or mobile applications, this includes details regarding your interactions with those systems.
- Image or Voice Data including images, video or photographs where you attend or speak at an event, or online recorded images or voice data where you participate in a webinar, video recording, podcast or event.
- Marketing and Communications Data includes your preferences in receiving marketing from us and our third parties and your communication preferences.
- Special Categories of Data includes, if you are an examination candidate or job applicant or volunteer applicant and you wish to share this data with us, information for a reasonable adjustment, or information on special characteristics, or information to support a special consideration application. Special category data may also include details of any publicly available criminal convictions, and your disciplinary history with CFA UK and CFA Institute including our contact with other professional bodies and the regulator.
Please note that we do not store payment card details on our systems. If you make a card payment online to pay for CFA UK services or products, you will be redirected to a secure payment service provider who will take your payment on our behalf and then return you to our website when your order has been completed.
All CFA UK qualifications include the opportunity for candidates to request reasonable adjustments prior to taking an examination. As part of this application process, personal data classified as a "special category" data may be collected. Such data is also collected where candidates wish to request a special consideration. This classification of data includes data about your physical or mental health. Where you are requesting a reasonable adjustment or special consideration, we will always require explicit consent from you to process that information for the stated purpose only.
There are a number of main methods of interaction with us: as a CFA UK qualification candidate, as a local CFA UK Member, as a CFA Institute Member with CFA UK as your local society, as a CFA UK member or non-member volunteer, or as a non-member individual interested in CFA UK’s products and services.
Based on those areas that apply to you, we collect and use your personal data for the following purposes:
- to communicate information about the products or services in which you have expressed an interest
- to communicate information about products and services directly related to those which you have already purchased / subscribed to
- for CFA UK, CFA Institute, or the CFA Society in your country if you are based outside the UK, to communicate information about products or services that relate to a CFA UK examination you have registered for
- to verify your identity
- to manage our relationship with you and administer your account, including payments
- to provide a qualification service, monitor examination results and performance, entitlements, digital badging, and ancillary products
- to maintain and manage your history of accreditations and qualifications and your membership history
- to provide membership services and associated benefits of membership
- to use images, recordings, video or voice recordings of members or customers in marketing or CFA UK brochures/reports
- to share names of recent Charterholders, or other members, who attend a CFA UK event, via email, newsletters, the website or social media channels
- to share information where needed with other professional bodies, in order to assist with their issuance of Statements of Professional Standing (SPS), including sharing information with those bodies on your past SPS history or qualifications held
- to provide the online community platforms that enable members and volunteers within a community to share ideas and resources
- to deliver, track and optimise our websites and digital services for members and customers
- to maintain the CFA UK online member and volunteer groups and directories
- to manage the CFA UK Board application process, and other committee and volunteer group applications including mentoring to book places on CFA UK events or courses including the delivery of the event or course and necessary follow-on processing
- to carry out statistical analysis, reporting, regulatory reporting and to improve our services
- to meet internal operational requirements
- to fulfil contracts with CFA Institute and/or a registered CFA Society in your country, relating to CFA UK’s qualifications
- to investigate and resolve complaints; and
- to carry out disciplinary, audit and regulatory functions.
To maintain accurate records, we may merge duplicate or differing records about you. This process complies with all legal requirements and due diligence. Our lawful basis for this is legitimate interests.
We ensure transparency by informing you about the merging process and its purpose. Security measures are in place to protect your data during this process.
You have the right to access, rectify, and object to the processing of your data. For any concerns, please contact us.
Where you engage with both CFA UK and CFA Institute, we may share and synchronise your personal data between our respective systems, in both directions, to support membership services, examination administration and qualification management. This means that CFA UK may share your personal data with CFA Institute, and CFA Institute may share your personal data with CFA UK. To help keep records accurate and consistent, either CFA UK or CFA Institute may be the source for certain personal data fields at different times, depending on your membership status and CFA Program or qualification activity. Further detail on this is available on our website.
We rely on one or more of the following processing conditions to process your personal data:
- to perform our obligations under any contracts that have been agreed with you in relation to membership, for qualifications, events or courses or verification services
- our legitimate interests in the effective delivery of information and services to you and in the effective and lawful operation of our businesses (provided these do not interfere with your rights)
- to satisfy any legal and regulatory obligations to which we are subject; and
- where no other condition for processing is available if you have agreed to us processing your personal data for the relevant purpose.
We share your personal data on your behalf for the purposes described in this Privacy Policy with CFA Institute, CFA Member Societies, service providers and sponsors of CFA UK. We take reasonable steps to ensure they act in accordance with our instructions and that they put suitable security measures in place to adequately protect your data. Where we share this data with our service providers, we may allow them to process it for the purposes of providing their services to us or complying with their own legal obligations. We do not give permission to our service providers to market to you for their own purposes without your explicit consent.
We share your personal data with the following parties:
- Pearson VUE and NCS Pearson Inc., based in the UK, the European Economic Area (‘EEA’) and in the USA, who deliver examinations on our behalf, or any other examination partners selected from time to time
- third party providers for delivery of products and services, based in the UK, the EEA or in the USA
- training providers who administer examinations on your or your employer’s behalf
- your employers who may register you for an examination, purchase services or products on your behalf
- where you have successfully completed a CFA UK qualification, with a digital credentialing provider
- where you are an event registrant, with event sponsors, event and course venues, providers or firms who manage our events and courses
- CFA Institute, based in the UK, the EEA and in the USA, where you are or were a joint member or a CFA Program candidate
- other CFA UK and CFA Institute board members, volunteers, members, and other CFA UK interest-based communities that you may choose to join, via our online community platform where your name will be made visible within the platform for the purpose of such parties communicating with and identifying you
- other professional bodies and regulators
- panels of members or volunteers if you are applying for the Board or other volunteer groups
- our board or committee members to the extent necessary for them to correspond with individuals to encourage further participation in CFA UK committees and groups
- other third parties where you provide consent to do so.
We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us.
If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.
Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.
We transfer your personal data to countries outside of the UK and the EEA for the purposes of delivery of examinations, events or courses, for the purposes of administering your membership record, for providing online community platform services, and to other third parties where you provide your consent. If you are a joint member of CFA UK and CFA Institute, or if you are a CFA Program candidate, your data will be transferred outside of the EEA as part of our data sharing arrangements with CFA Institute.
Where we collect your personal data within the UK or EEA, transfer outside the EEA will only be:
- to a recipient located in a country which provides an adequate level of protection for your personal information; and/or
- under an agreement or mechanism which satisfies EU requirements for the transfer of personal data to data processors or data controllers outside the EEA, such as standard contractual clauses (SCCs) approved by the European Commission or the EU-US Data Privacy Framework, in relation to transfers of personal data from the EEA to the USA.
We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.
To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.
In some circumstances we will anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.
To protect the security of your personal data, we have appropriate technical and security measures in place including both physical and technical safeguards. We have a governance model that ensures adequate policies, procedures and controls are in place to manage the risks.
Although we use appropriate security measures once we have received your personal data, the transmission of data over the Internet (including by email) is never completely secure. We endeavour to protect personal data, but we cannot guarantee the security of data transmitted to or by us.
Under certain circumstances, you have rights under data protection laws in relation to your personal data, including the right to:
- Request access to your personal data (commonly known as a data subject access request). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.
- Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.
- Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.
- Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.
- Request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in the following scenarios:
- If you want us to establish the data's accuracy.
- Where our use of the data is unlawful, but you do not want us to erase it.
- Where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims.
- You have objected to our use of your data, but we need to verify whether we have overriding legitimate grounds to use it.
- Request the transfer of your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.
- Withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain services to you. We will advise you if this is the case at the time you withdraw your consent.
- Complain about how CFA UK has used your personal information
Please send an email to privacy@cfauk.org including ‘Data Protection Complaint’ in the subject line, if you believe that CFA UK has not handled your personal information properly or has not complied with data protection law.
For example, you can complain about:
- how we collected, used, shared, stored or deleted your personal information;
- the accuracy or security of your personal information;
- how we responded to a request to access, correct, erase or restrict your personal information;
- direct marketing or communications sent to you;
- a personal data breach or disclosure;
- an automated decision involving your personal information; or
- another concern about CFA UK’s handling of your personal information.
Please do not provide more personal information than is necessary to explain your complaint. Do not include bank details, passwords or copies of identity documents unless we specifically ask you to provide them securely.
If you need help making a complaint, contact us at privacy@cfauk.org or please telephone +44 (0) 20 7648 6200.
We will acknowledge your complaint within 30 days of receiving it. We will then investigate your complaint, keep you informed of our progress and any expected timeframes, and tell you the outcome without undue delay.
If you are not satisfied with how we have handled your complaint, you have the right to complain to the Information Commissioner’s Office (ICO), the UK regulator for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO, so please contact us in the first instance.
If you wish to exercise any of the rights set out above, please contact us.
No fee usually required
You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we could refuse to comply with your request in these circumstances.
What we may need from you
We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.
Time limit to respond
We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.
Where we are legally required to obtain your consent to provide you with marketing materials, we will only provide you with such marketing materials if you have provided consent for us to do so.
If you want to unsubscribe from mailing lists or any marketing, you should follow the unsubscribe link provided in the relevant communications.
If you do not wish to receive marketing communications from us, you can at any time contact us to request that such communications cease. If you choose to unsubscribe from any or all mailings, we may retain information sufficient to identify you so that we can honour your request.
You can manage your email preferences via the CFA UK preference centre which is included in a link on all CFA UK emails you receive.
Last updated: 12 August 2026