Citizens Advice in West Sussex (North, South, East) (CAWS) Privacy Policy

 At Citizens Advice in West Sussex (North, South, East) (CAWS), we collect and use your personal information to help solve your problems, improve our services and tackle wider issues in society that affect people’s lives.

 This privacy policy explains how we use your information and what your rights are. We handle and store your personal information in line with data protection law and our confidentiality policy. The following tells you more about how we use your information in more detail.

See also:

Our Volunteer Privacy Policy

Our Website and Cookie Policy

Our network

Citizens Advice is a membership organisation made up of the national Citizens Advice charity and many local offices across England and Wales, including Citizens Advice in West Sussex (North, South, East) (CAWS). Citizens Advice in West Sussex (North, South, East) (CAWS) is an independent charity and a member of the national Citizens Advice charity.

All members of the Citizens Advice network are responsible for keeping your personal information safe and making sure data protection law is followed.

Members of the network also run some jointly designed services and use some of the same systems to process your personal data. In these instances we are joint data controllers for these activities.

Jointly controlled data

All offices in the Citizens Advice network use some joint systems to carry out our activities. These include joint case management systems, telephony platforms and more.

Staff from a different local Citizens Advice can only access your personal information in a joint system if they have a good reason. For example when:

• you go to a different office to seek advice
• more than one office is working together in partnership for example our West Sussex Adviceline in partnership with Arun and Chichester Citizens Advice
• they need to investigate a complaint or incident

We have rules and controls in place to stop people accessing or using your information when they shouldn’t. Tell an adviser if you’re worried about your details being on a national system. We’ll work with you to take extra steps to protect your information – for example by recording your problem without using your name.

National Citizens Advice has an privacy notice available on their website that covers general advice and nationally managed systems, including our case management systems. This policy covers the processing we carry out in our office.

Third party processors 

Third party processors are other organisations that carry out data processing on our behalf. Third party processors don’t use data for their own purposes and we have agreements in line with data protection law.

How we use your data for advice

This section covers how we use your data to provide you with advice. For general advice and nationally funded advice programmes please see the national Citizens Advice privacy notice.

How we collect your information

When we provide advice we either collect this data directly from you or receive it through a referral from a partner organisation.

We will collect this data in different ways depending on how you approach our service, including:

• face to face – for example by discussing your situation with an advisor
• completing a form – this could be a digital form or paper form
• over the phone – for example by calling Adviceline or calling us directly
• email
• Video advice
• webchat

We also receive information from partner organisations through referral mechanisms. Where you are referred to us, you should be advised that you are being referred as well as what information we will be provided by our referral partners.  For example via the local authority for homelessness prevention projects or Health Care Professionals for the Macmillan Benefits Service.

What information we collect

To support your enquiry we collect information about you and your circumstances. You can choose which information you give us, but not providing certain information may limit the advice we can give you. This may include:

• your name – you can ask to remain unnamed but this may limit the advice we are able to provide
• contact details such as your address, phone number and email address
• profile information such as your date of birth and whether you have any accessibility requirements

We will also collect any information about your issue which could help us provide you with advice which can include:

• information about your finances – for example your income, expenditure, debts, benefits or pension
• credit reports – we may get copies of your credit history with your permission
• details of the products or services you are having issues with
• details of your housing such as your rent, mortgage and housing conditions
• information about your health or disability
• details of any discrimination you face

If you contact us by phone we will also record the phone call for training and monitoring purposes.

You may also be asked to provide demographic information at your advice session.  This will not affect the advice you receive and will be used to provide holistic support and understand more about our service. For more information see the section on statistical processing.

Information about Third Parties

We may also gather information about you if you aren’t one of our clients. We will do this if it is relevant to provide a client with advice. For example, to assist a client with a debt assessment we will need relevant financial information about members of their household.

What we use your information for

We use the information you give us to:

• provide you with advice, guidance and information
• stay in touch with you about the advice we are providing
• help with applications such as a debt recovery order or benefit claim 
• training our staff and volunteers
• assess the quality of our advice
• investigate complaints or claims
• get feedback from you about our services
• help us improve our services
• address the root causes of the issue you are experiencing
• share stories about your experience with Citizens Advice, with your permission

We may also record any unacceptable behaviour from clients if we deem this to cause disruption to our service or threaten the wellbeing of our staff, volunteers or any other person.

In some circumstances we may also use your information to carry out legal obligations, including for:

• safeguarding
• fraud prevention
• regulatory compliance

Our confidentiality policy

At Citizens Advice we have a confidentiality policy which states that anything you tell us as part of advice will not be shared outside of the Citizens Advice network unless you provide your permission for us to do so.

There are some exceptions to this such as needing to share:

• to prevent an immediate risk of harm to an individual
• In select circumstances if it is in the best interests of the client
• where we are compelled to do so by law (e.g. a court order or meeting statutory disclosures)
• where there is an overriding public interest such as to prevent harm against someone or to investigate a crime
• to defend against a complaint or legal claim
• to protect our name and reputation for example to provide our side of a story reported in the press

Who we share your information with

Referrals into the service

When you give us authority to act on your behalf, for example to help you with a Universal Credit claim, we’ll need to share information with a third party.   For more information about how your data is used for the Help to Claim service see https://www.citizensadvice.org.uk/about-us/information/help-to-claim/

We may also need to provide feedback and joint working to a funder.  In all instances we will obtain your consent before we do this and it will be made clear as part of the referral into the project.  Organisations we may share co-work or need to report back are:

• West Sussex Local Authorities Homelessness Prevention Projects
• West Sussex Local Authorities Household Support Grant Referrals
• Universal Credit DWP for help in making a claim

In addition to the categories below, we may also ask to refer you to another organisation who we think will be able to provide you with more support. We will ask your permission to make any such referral.

Referral partners

We will share your information with partners when we want to refer you to another service. This may be as part of a jointly run service or where we believe another organisation may be better placed to provide you with the advice you need. We will only make a referral when you have given us your permission to do so. 

Some established referral partners include:

• Trussell Trust Foodbanks – to issue you with a food bank voucher
• Fuel bank foundation – to issue you with a fuel voucher
• Local Authority Household Support Grants – to apply for a grant including goods
• Charitable grant foundations – to apply for a grant

Funders

We share information with our funders in order to demonstrate that we are meeting the funding requirements. Information will normally only be shared in a de-identified manner unless you give us your permission to do so or we need to in order to investigate a quality issue, complaint or claim.

 Regulators

We are legally required to provide information to regulatory bodies in some circumstances. These include but are not limited to:

The Financial Conduct Authority – the regulator for financial and banking services

Auditors

We share information with our internal and external auditors to allow them to carry out audits to ensure that we are complying with our legal obligations and standards of best practice in how we run the organisation.

Banks, credit reference agencies and creditors

We may also share your information with banks or creditors to help get information to assist in our advice. We will only do this with your permission or where we are legally required to do so. Information we share will be used for purposes including:

• getting a credit report to assist with financial enquiries
• understanding more about your income and expenditure 
• understanding more about the debts you owe

Employers or benefit providers

We may also contact your employer or benefit provider to understand more about your income, we will only do this with your permission.

Translation and interpretation services

We may share your information with a translation or interpretation service to enable us to communicate with clients who prefer communication in different languages.

Our lawful basis for using your information                

 

Activity	Lawful basis for collecting personal data	Lawful basis for collecting special category or criminal convictions data
Advice, Information, Guidance, Support and Casework (unless listed below)	Legitimate interests – we have a legitimate interest to provide advice to our clients	Establishment, exercise or defence of legal claims –  where we are helping clients establish their legal rights Substantial Public Interest (provision of confidential counselling, advice or support) – where we are providing advice to clients which doesn’t relate to their legal rights.
Energy advice	Public task – where sub-contracted by National we have a statutory obligation to provide energy advice	Substantial public interest (statutory obligation) –  where sub-contracted, we have a statutory obligation to provide consumer and energy advice
Debt relief orders	Public task – we have a public task through our funder the Money and Pensions Service to assist with debt relief orders	Establishment, exercise or defence of legal claims –  where we are helping clients establish their legal pension rights
Equity, Diversity and Inclusion (EDI) monitoring	Legitimate interests – We have a legitimate interest in processing EDI data to ensure we are promoting equity and diversity in our service. We have a full legitimate interest assessment for this processing	Substantial public interest – Processing of information relating to race or ethnicity, religious or philosophical  beliefs, health (including disability), and sexual orientation for the purpose of enabling , promoting or maintaining equality of treatment. Specifically we rely on is in the Data Protection Act 2018, Schedule 1, (8) ‘equality of opportunity or treatment’. This substantial public interest category only applies to specific Special Category Data criteria listed above and does not extend to criminal offence data. However criminal offence data is not processed for EDI monitoring.
Accessibility requirements	Legal obligation – we have legal obligations in accordance with the equalities legislation	Substantial public interest (statutory obligation) – obligations under equalities legislation.
Marketing new services	Legitimate interests – we have a legitimate interest in promoting advice services which could benefit our clients Consent – where marketing rules require consent to do so	N/A unless on a case by case basis for example new cancer support for cancer patients via Macmillan funded service
Statistical purposes and research (including feedback)	Legitimate interests – We have a legitimate interest to carry out statistical analysis and research using our client data. We have carried out a legitimate interest assessment for statistical processing, research and policy formation. We may also keep pseudonymised data for archival purposes.	Archiving, research and statistics (Anonymised)
Maintaining quality and standards	Legitimate interests – we have a legitimate interest in ensuring that our service is run properly and that standards are maintained	Establishment, exercise or defence of legal claims Substantial public interest (protecting the public against dishonesty etc) – where we are carrying out functions to protect against: – dishonesty, malpractice or other seriously improper conduct – unfitness or incompetence – mismanagement in administration
Publication of client stories	Consent – Where we seek to publish client stories in an identifiable format, we will always get client consent. Clients will always be given a genuinely free and fair choice.   NB: If fully deidentified a lawful basis is not required for publication itself – care must be taken to ensure they cannot be re-identified.	Explicit Consent
Safeguarding	Public task – in complying with safeguarding obligations	Substantial public interest (Safeguarding of children and of individuals at risk)
Responding to a life threatening emergency	Vital Interests – where a person’s life may be in danger	Vital Interests – where a person’s life may be in danger
Legal Claims and Complaints	Legitimate interest  – We have a legitimate interest to investigate complaints and to implement lessons learned from them. Establishment, exercise or defence of legal claims	Establishment, exercise or defence of legal claims
Fraud prevention	Legitimate interests – we have a legitimate interest in defending against fraudulent activity Legal obligation – in some circumstances there are legal obligations to disclose actual or suspected cases of fraud	Substantial public interest – (preventing and detecting unlawful acts, preventing fraud, Suspicion of terrorist financing or money laundering)

How we use your data for research, feedback and statistics

This section covers how we use your data to carry out our research, feedback and statistical work.

We carry out research and statistics using data from a number of sources including:

• Client case data – we use client case information to carry out research and produce statistical information
• Surveys and questionnaires – we carry out specific questionnaires and surveys to get data on specific topics
• Focus groups, interviews and studies – we invite key stakeholders to take part in studies and discussions
• Community Participation Action Research – we will work with stakeholders to provide insight, discussions and share experiences

We will only contact you directly about research and feedback if you have given your permission for us to do so.

What information we collect

We use a wide range of information which can include:

• Information about the issues you sought advice or guidance about
• Your demographic information such as what area of the country you live in, your age or any minoritised groups you identify with
• Your opinions about our service or themes relevant to them such as benefits or housing
• Your opinions and experiences including about wider services and support

For how National Citizens Advice use of data for this purpose see their privacy notice.

What we use your information for

We use our research and statistics to inform our campaigns and to improve our service. This includes work to promote equity, diversity and inclusion within our service and society as a whole.  We will not use any of this data in a way that identifies you or to make a decision about you as part of our research unless you give us your permission to do so.

Sometimes we like to include real client stories in our campaigns, if we want to use your story in a way that you can be identified we will only do so with your permission.

Who we share your information with

We will not share directly identifiable information about you outside of Citizens Advice unless:

• you give your permission for us to do so 

We may from time to time share data sets with de-identified data with trusted partners to allow them to do their own research. For example we may share data sets with identifiers such as names, addresses, contact details removed with a trusted third party such as a university to help them do research which is in the public interest.

How we use your data for fundraising and donations

This section covers how we use your data to carry out our fundraising activities.

National Citizens Advice covers their use of data for fundraising in their privacy notice.

How we collect your information

We may hold information about you if you make a donation to the charity, for example via online giving platforms – see their privacy notices for how they use data. 

What information we collect

If you provide a donation we may keep your personal detail, the amount and whether there was an intention connected to the donation.

What we use your information for

We use the data for our financial records and audit purposes, including where we can claim giftaid.   We may also contact you to provide you an update about our work and use of the funds which you can opt out.  You can also make anonymous donations.

Who we share your information with

We will only share your details with your permission unless we are required by law to do so.

How we use your data when applying to work or volunteer

See our candidate and volunteering privacy policies.

How long we keep your data for

National Citizens Advice is responsible for managing any data in joint client case records. For more information please see their privacy notice.

 Below is a summary of our retention.

Data	Purpose	Retention
Advice case records*	General advice		6 years
	Cases with historical significance		16 years
	Cases with an increased risk of a legal claim		16 years
	Cases that form part of an active inquiry		16 years or until the closure of the inquiry, whichever is longest
Advice Webchats	Chats with an adviser online		13 months
Call recordings	Adviceline calls		6 months
	Witness Service calls		6 months
	Pensionwise		2 years
Complaints	General complaints		6 years
	Complaints involving a financial claim or court action involving insurers		16 years
Donations	General donation records		7 years from end of financial year
	Legacies, Wills, Bequests		7 years from closure of estate
Information requests	Information requests under Data Protection or Freedom of Information Law		6 years
Safeguarding concerns	Any concerns relating to the safeguarding of children or vulnerable adults		16 years

 

*Case information will be de-identified at the end of its retention period. We will retain summary level data for statistical and research purposes after this period has passed.

Your data protection rights

You have rights in relation to your personal data that we hold. Your rights include being able to request:

• Access to copies of your data
• Corrections are made to inaccurate data
• Deletion of your personal data
• Object to how we use your personal data

These rights are not absolute and may not apply in every circumstance. For more information about your rights you can visit the ICO website.

To make a data protection rights request you can do so by emailing privacyinfo@westsussexcab.org.uk

Raising a concern about how we use your information

If you are concerned about how we have handled your personal information please contact us at privacyinfo@westsussexcab.org.uk

You can also contact the national charity if you are unhappy with how we have used your personal data or wish to raise a concern about how a local office has handled your personal data. To do so you can email us at DPO@citizensadvice.org.uk

Contacting the Information Commissioner’s Office (ICO)

You can also raise your concern with the Information Commissioner’s Office which regulates data protection law in the UK. if you are unhappy with how we have used your personal information. They will normally expect you to have made a complaint to us directly in the first instance.

• Visit the ICO website.
• Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
• Helpline number: 0303 123 1113