Your data. Not HSBC’s.

Who we are

Bad HSBC is the data controller for information submitted through this website. Contact us through the contact form.

What we collect

• Story form: your email, optional first name or initials, region, the HSBC brand you use, the details of your experience, and the permissions you tick.
• Contact form: your email, optional name and organisation, and your message, for corrections, replies or tips.
• We don’t use advertising or tracking cookies, and we don’t run analytics that identify you.

Why we use it, and our lawful basis

• To read and assess your story and contact you about it: your consent, given when you submit.
• To publish an anonymised version: only if you tick that box (consent).
• To put you in touch with other affected customers or journalists: only if you tick that box, and we ask before sharing your details with anyone (consent).

Your story may contain information about your finances or health. We treat it as confidential and only process it with your explicit consent. You can withdraw consent at any time through the contact form; we’ll delete your submission and remove any published version.

Who processes it

Form submissions are stored on our own server, which we rent from a hosting company acting as our processor. They are not sent to any third-party form or marketing service. We don’t sell your data or share it with HSBC, claims companies or marketers.

How long we keep it

Up to 24 months, or less if you ask us to delete it. Published anonymised stories stay online until you ask us to remove them.

Your rights

You can access, correct or delete your data, object to or restrict its use, and withdraw consent. Use the contact form to exercise these rights. If you’re unhappy with how we handle your data, you can complain to the Information Commissioner’s Office.