At Citizens Advice Middlesbrough we collect and use your personal information to help solve your problems, improve our services and tackle wider issues in society that affect people’s lives.
We only ask for the information we need. We always let you decide what you’re comfortable telling us, explain why we need it and treat it as confidential.
When we record and use your personal information we:
· only access it when we have a good reason;
· only share what is necessary and relevant;
· don’t sell it to anyone.
We collect and use the details you give us so we can help you. We have a ‘legitimate interest’ to do this under data protection law. This means it lets us carry out our aims and goals as an organisation. We handle and store your personal information in line with the law – including the General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
You can view the Citizens Advice national policy for details on how we handle most of your information: www.citizensadvice.org.uk/about-us/information/citizens-advice-privacy-policy/
At Citizens Advice we have a confidentiality policy which states that anything you tell us as part of advice will not be shared outside of the Citizens Advice network unless you provide your permission for us to do so.
There are some exceptionsto this such as needing to share:
· To prevent an immediate risk of harm to an individual
· In select circumstances if it is in the best interests of the client
· Where we are compelled to do so by law (e.g. a court orderor meeting statutory disclosures)
· Where there is an overriding public interest such as to prevent harm against someone or to investigate a crime
· To defend against a complaint or legal claim
· To protect our name and reputation for example to provide our side of a story reported in the press
This policy covers how Citizens Advice Middlesbrough handles your information locally in our offices.
When you get advice from Citizens Advice Middlesbrough
What information we ask for
We ask for information that’s relevant to your problem. Depending on what you want help with, this might include:
· your name and contact details – so we can keep in touch with you about your case;
· personal information – for example about family, work, or financial circumstances.
We may also ask for sensitive information like your ethnicity, health, or sexual orientation. Sometimes this information might be needed to help us answer your enquiry. We also ask for this kind of information to help us ensure that our services are accessible to everyone that might need our help. This kind of information is known as ‘special category data’. If you don’t want to give us this information you don’t have to, but if it’s relevant to your enquiry we might not be able to answer your question or give you tailored information or advice about your situation – it may limit the service we can offer if we don’t have the information.
How we use your information
The main reason we ask for your information is to help solve your problem.
We only access your information for other reasons if we really need to – for example:
· for training and quality purposes;
· to investigate complaints;
· to get feedback from you about our services;
· to help us improve our services.
All advisers and staff accessing data have had data protection training to make sure your information is handled sensitively and securely.
The basis on which we use your information
We rely upon UK GDPR Article 6 as the lawful condition for processing your personal data for the purposes of
· Advice, information and guidance provision: Article 6f –legitimate interests.
· EDI monitoring: Article 6f – legitimate interests.
· Accessibility and reasonable adjustments: Article 6c – legal obligation.
· Statistical purposes, research and feedback: Article 6f – legitimate interests.
· Maintaining quality and standards: Article 6f – legitimate interests.
· Complaints: Article 6f – legitimate interests.
· Legal claims: Article 6f – legitimate interests.
· Individual rights requests: Article 6f – legitimate interests.
· Direct marketing of our services: Article 6f – legitimate interests or Article 6a consent, if electronic marketing.
· Safeguarding: Article 6e – public task.
· Fraud prevention: Article 6f – legitimate interests and Article 6c – legal obligation.
· Responding to a life threatening emergency: Article 6d –vital interest.
We rely upon UK GDPR Article 9 as the lawful condition for processing your special category data for the purposes of:
· Advice, information and guidance provision: Article 9(2)(f) – establishment, exercise or defence of legal claims or Article 9(2)(g)substantial public interest – confidential counselling, advice or support.
· EDI monitoring: Article 9(2)(g) substantial public interest)
· Accessibility and reasonable adjustments (Article 9(2)(g) substantial public interest.
· Statistical purposes, research and feedback: Article9(2)(j) – archiving, research and statistics.
· Maintaining quality and standards: Article 9(2)(f) –establishment, exercise or defence of legal claims or Article 9(2)(g) substantial public interest.
· Complaints: Article 9(2)(f) – establishment, exercise or defence of legal claims or Article 9(2)(g) substantial public interest.
· Legal claims: Article 9(2)(f) – establishment, exercise or defence of legal claims.
· Individual rights requests: Article 9(2)(g) substantial public interest.
· Safeguarding: Article 9(2)(g) substantial public interest.
· Fraud prevention: Article 9(2)(g) substantial public interest.
· Responding to a life threatening emergency: Article 9(2)(c) vital interest.
Understanding people’s problems
We use some information to create statistics and case studies about who we’re helping and what problems are the most common. This information is always anonymised – you can’t be identified.
We share these statistics and case studies with funders, regulators, government departments and publicly on our blogs, reports, social media and press releases.
The statistics also inform our policy research, campaigns, or media work.
When we share your information with other organisations
With your permission, we might share your information with other organisations to help solve your problem or to monitor the quality of our services.
Organisations we share your data with must store and use your data in line with data protection law.
Sharing information to solve your problem
When you give us authority to act on your behalf, for example to help you with challenging a benefit decision, we will need to share your information with that third party. You will need to give us consent for this.
If we refer you to another organisation for support, we will need to share information about you and may also need to share information about your enquiry so they can help you. You will need to give us consent for this.
Monitoring our quality of service
With your permission, we will store your contact details so we can contact you for feedback on your experience with us.
If we’re concerned about your or someone else’s safety
If something you have told us makes us think you or someone you know might be at serious risk of harm, we could tell the police or social services – for example if we think you might hurt yourself or someone else. This is to try and protect you and/or others.
If you are the client of a different service and they refer you to us for advice
With your permission, your personal information is shared with us from that organisation that has referred you. That organisation will have their own policy on how they use, store and share your data.
How we store your information
Your information will be stored on an online case management system:
· Casebook – managed nationally by Citizens Advice
In addition a small amount of information may be kept temporarily by Citizens Advice Middlesbrough in electronic or paper formats until it is transferred into Casebook. Once information has been entered into Casebook local electronic and paper files will be deleted/confidentially destroyed.
If you’ve been contacted to help with research, campaigns or news – our Privacy Policy
If we’ve contacted you for help with research, campaigns or media work, we’ll have collected information from you by either:
· talking with you over the phone, face to face or by email
· accessing your records on our case management system – if you’ve got advice from us before
We’ll always tell you how we’ll use your information and ask your permission. For example, by signing a paper consent form, giving agreement over the phone or ticking a box online.
If we want to record an interview with you, we’ll ask.
What information we ask for
We only ask for the information we need to tell your story or inform our research. Depending on how we want you to help us, this might include information about:
· your situation like family, work or financial circumstances – and how it affects you
· how you use Citizens Advice and other organisations’ services – and what you thought about them
· your name and contact details – so we can keep in touch with you
· demographic information like your gender, ethnicity or sexual orientation
If you don’t want to give us some personal details, you don’t have to.
How we use and share your information
When we contact you we’ll explain how we want to use your information – for example, we might want to:
· ask you to share your story with the media
· include your information in a report or blog as part of our research and campaigns, or media work
· use your information to improve our services
If we’re sharing your story publicly, you can stay anonymous if you want to – we’ll change some details of your story to make sure you can’t be identified.
We might share your information with government or industry regulators as part of our campaigns and policy work.
Storing your information
Copies of your records and any new interview notes are kept securely on our internal systems. We keep your data for up to 6 years. If your case has been subject to a serious complaint, insurance claim or other dispute we keep the data for 16 years.
If you make a compliant about our service – our privacy policy
If you make a complaint, we collect personal information from you so we can help deal with your complaint.
We collect your information from you via phone, email, online form or letter – depending on how you complain.
What information we ask for
So we can help you with your complaint, we need to know:
· your name
· one way we can get in touch with you – email, phone or address
· details of the complaint
You don’t have to tell us, but we’ll also ask you about your:
· address
· phone number
· problem – for example, whether you wanted help with debt or housing
If you tell us you’ve a disability or support need, we’ll also make a note of that so we can help you access our services.
If your complaint is about advice you received, we might need to look at the information we’ve recorded about your issue.
How we use your information
We use the information you give us to deal with your complaint. We’ll only access your information for other reasons if we really need to – for example:
· for training and quality purposes
· to include anonymised complaint statistics in internal reports
All staff accessing data have done data protection training to make sure your information is handled sensitively and securely.
When we share your data
If you escalate your complaint to Citizens Advice or an external independent adjudicator, we’ll share your complaint information with them.
If your complaint involves an insurance claim, we might share details of your complaint with our insurer.
Storing your information
We’ll store your information securely on our internal systems.
We keep your data for at least 6 years. If your complaint is serious or involves an insurance claim or other dispute we keep the data for 16 years.
Contact Citizens Advice Middlesbrough about your information
If you have any questions about how your information is collected or used, you can contact our office at:
Data Protection Officer
Citizens Advice Middlesbrough
3 Bolckow Street
Middlesbrough
TS1 1TH
You can contact us to:
· find out what personal information we hold about you
· correct your information if it’s wrong, out of date or incomplete
· request we delete your information
· ask us to limit what we do with your data – for example, ask us not to share it if you haven’t asked us already
· ask us to give you a copy of the data we hold in a format you can use to transfer it to another service
· ask us to stop using your information
Who is responsible for looking after your personal information
The national Citizens Advice charity and Citizens Advice Middlesbrough operate a system called Casebook to keep your personal information safe. This means they’re a ‘joint data controller’ for your personal information that’s stored in our Casebook system.
Each local Citizens Advice is an independent charity, and a member of the national Citizens Advice charity. The Citizens Advice membership agreement also requires that the use of your information complies with data protection law.
You can find out more about your data rights on the Information Commissioner’s website.