Privacy Policy
At Citizens Advice Merthyr Tydfil, we collect and use your personal information to help solve your problems, improve our services and tackle wider issues in society that affect people’s lives. This privacy policy explains how we use your information and what your rights are. We handle and store your personal information in line with data protection law and our confidentiality policy. The following pages tell you more about how we use your information in more detail.
Our Network
Citizens Advice is a membership organisation made up of the national Citizens Advice charity and many local offices across England and Wales, including Citizens Advice Merthyr Tydfil. Citizens Advice Merthyr Tydfil is an independent charity and a member of the national Citizens Advice charity.
All members of the Citizens Advice network are responsible for keeping your personal information safe and making sure data protection law is followed. Members of the network also run some jointly designed services and use some of the same systems to process your personal data. In these instances we are joint data controllers for these activities.
Jointly Controlled Data
All offices in the Citizens Advice network use some joint systems to carry out our activities. These include joint case management systems, telephony platforms and more. Staff from a different local Citizens Advice can only access your personal information in a joint system if they have a good reason. For example when:
- you go to a different office to seek advice
- more than one office is working together in partnership
- they need to investigate a complaint or incident
We have rules and controls in place to stop people accessing or using your information when they shouldn’t. Tell an adviser if you’re worried about your details being on a national system. We’ll work with you to take extra steps to protect your information – for example by recording your problem without using your name.
National Citizens Advice has a privacy notice available on their website that covers general advice and nationally managed systems, including our case management systems. This policy covers the processing we carry out in our office.
How We Use Your Data for Advice
This section covers how we use your data to provide you with advice. For general advice and nationally funded advice programmes please see the national Citizens Advice privacy notice.
How We Collect Your Information
We will collect information from you at the first point of contact, whether that is in person or over the phone. We will collect your name, address, date of birth and contact details as standard. Any other information we need to collect will depend on the nature of your query.
What Information We Collect
We’ll only ask for information that’s relevant to your problem. Depending on what you want help with, this might include:
- your name and contact details – so we can keep in touch with you about your case
- personal information – for example about family, work, or financial circumstances, or if you’re vulnerable or at risk of harm
- details about services you get that are causing you problems – like energy or post
- details of items or services you’ve bought and traders you’ve dealt with
- information like your gender, ethnicity or sexual orientation
We occasionally ask for details about someone else like a neighbour or your partner so we can deal with an enquiry. We’ll only do this if we have a legitimate interest in the information, or we need it to protect someone’s life. If you don’t want to give us certain information, you don’t have to. For example, if you want to stay anonymous we’ll only record information about your problem and make sure you’re not identified.
What We Use Your Information For
The main reason we ask for your information is to help solve your problem. We only access your information for other reasons if we really need to. Data protection law lets us do this as long as we either get your consent or we have a legitimate interest. For example we have a legitimate interest to access your data:
- for training and quality purposes
- to investigate complaints
- to get feedback from you about our services
- to help us improve our services
All advisers and staff accessing data have had data protection training to make sure your information is handled sensitively and securely.
Our Confidentiality Policy
At Citizens Advice we have a confidentiality policy which states that anything you tell us as part of advice will not be shared outside of the Citizens Advice network unless you provide your permission for us to do so. There are some exceptions to this such as needing to share:
- to prevent an immediate risk of harm to an individual
- in select circumstances if it is in the best interests of the client
- where we are compelled to do so by law (e.g. a court order or meeting statutory disclosures)
- where there is an overriding public interest such as to prevent harm against someone or to investigate a crime
- to defend against a complaint or legal claim
- to protect our name and reputation for example to provide our side of a story reported in the press
Who We Share Your Information With
With your permission, we might share your information with other organisations so we can:
- help solve your problem – for example, if you ask us to contact your creditors we might need to share your name, address and financial details with them
- refer you quickly to another organisation for more advice or support, if relevant
- help you access certain services – for example food banks or Trading Standards
- monitor the quality of our services
Organisations we share your data with must store and use your data in line with data protection law. They’ll have their own privacy policies for how they handle your information and keep it safe. There might be specific organisations we share your information with, depending on what service you access.
If you’re in Wales, we’ll use a system called Refernet if we need to refer you to another organisation – or if another organisation refers you to us. If you’re referred through Refernet, your information will be stored securely on the Refernet system. We keep your information on Refernet for a year from the date you’re referred. After a year, your information is deleted.
Our Lawful Basis for Using Your Information
| Purpose | Personal Data (UK GDPR Article 6 requirement) | Special Category and Criminal Offence Data (UK GDPR Article 9 or 10 requirement) | Opt in/out required? |
|---|---|---|---|
| Advice, information and guidance provision | Article 6(1)(f) – Legitimate interests Article 6(1)(e) – Public task | Article 9(2)(f) – establishment, exercise or defence of legal claims Article 9(2)(g) – substantial public interest (statutory) Article 9(2)(g) – substantial public interest (confidential counselling, advice or support) | No, though clients may have the option of being unnamed |
| EDI monitoring | Article 6(1)(f) – Legitimate interests | Article 9(2)(g) – substantial public interest | Yes, clients and witnesses should be given the option of providing this data including ‘prefer not to say’ options |
| Accessibility and reasonable adjustments | Article 6(1)(c) – Legal obligation | Article 9(2)(g) – substantial public interest | Yes, clients can choose whether they provide this data or not |
| Statistical purposes and research (including feedback) | Article 6(1)(f) – Legitimate interests | Article 9(2)(j) Archiving, research and statistics | Generally not required unless it involves client contact in which case an opt in should be offered |
| Direct marketing of Citizens Advice Services | Article 6(1)(f) – Legitimate interests Article 6(1)(a) – Consent | SCD should generally not be processed for this purpose. | Yes, or consent |
| Publication of client stories | Article 6(1)(a) – Consent | Article 8(a)(a) – Explicit Consent | Consent should be used if clients are identifiable |
| Maintaining quality and standards | Article 6(1)(f) – Legitimate interests | Article 9(2)(f) – establishment, exercise or defence of legal claims Article 9(2)(g) – substantial public interest | No |
| Complaints | Article 6(1)(f) – Legitimate interests | Article 9(2)(f) – establishment, exercise or defence of legal claims Article 9(2)(g) – substantial public interest | No |
| Legal claims | Article 6(1)(f) – Legitimate interests | Article 9(2)(f) – establishment, exercise or defence of legal claims | No |
| Individual rights requests | Article 6(1)(c) – Legal obligation | Article 9(2)(g) – substantial public interest | No |
| Safeguarding | Article 6(1)(e) – Public task | Article 9(2)(g) – substantial public interest | No |
| Fraud prevention | Article 6(1)(f) – Legitimate interests Article 6(1)(c) – Legal obligation | Article 9(2)(g) – substantial public interest | No |
| Responding to a life-threatening emergency | Article 6(1)(d) – Vital interests | Article 9(2)(g) – Vital interests | No – should only be used where a person cannot consent to this processing |
How We Use Your Data for Research, Feedback and Statistics
This section covers how we use your data to carry out our research, feedback and statistical work. National Citizens Advice covers their use of data for this purpose in their privacy notice.
How We Collect Your Information
Information can be gathered via a telephone call or survey.
What Information We Collect
This includes personal information (such as age, gender, sexual orientation, religion).
What We Use Your Information For
Data may be used to personalise your experience, address issues, training needs and to ensure a better client journey.
Our Lawful Basis for Using Your Information
| Purpose | Personal Data (UK GDPR Article 6 requirement) | Special Category and Criminal Offence Data (UK GDPR Article 9 or 10 requirement) | Opt in/out required? |
|---|---|---|---|
| EDI monitoring | Article 6(1)(f) – Legitimate interests | Article 9(2)(g) – substantial public interest | Yes, clients and witnesses should be given the option of providing this data including ‘prefer not to say’ options |
| Statistical purposes and research (including feedback) | Article 6(1)(f) – Legitimate interests | Article 9(2)(j) Archiving, research and statistics | Generally not required unless it involves client contact in which case an opt in should be offered |
| Direct marketing of Citizens Advice Services | Article 6(1)(f) – Legitimate interests Article 6(1)(a) – Consent | SCD should generally not be processed for this purpose. | Yes, or consent |
| Maintaining quality and standards | Article 6(1)(f) – Legitimate interests | Article 9(2)(f) – establishment, exercise or defence of legal claims Article 9(2)(g) – substantial public interest | No |
| Legal claims | Article 6(1)(f) – Legitimate interests | Article 9(2)(f) – establishment, exercise or defence of legal claims | No |
How We Use Your Data When Applying to Work or Volunteer
How We Collect Your Information
Information is collected via an application form and stored on Google Workspace for 6 years.
What Information We Collect
We will collect your name, address, date of birth and contact details as standard.
What We Use Your Information For
We may use your information for any DBS checks or references.
Who We Share Your Information With
We may share your details with obtaining a DBS check or contacts you supply for any references.
How We Use Your Data When Using Our Website
What Information We Collect
When you browse our website, we collect ‘cookies’ to help us understand more about how our site is used by visitors, and to develop and improve our services to you. If completing an online form we collect personal details to help with our query.
How We Collect Your Information
Your information is collected via an online form or via cookies.
What We Use Your Information For
We use cookies to:
- track aspects of your visits, including the length of your visit, your browser, geographic location and the use of the search facility on this website
- remember the contrast and/or text resizing style preferences you’ve chosen for this website – if relevant
Who We Share Your Information With
With your permission, we might share your information with other organisations to help resolve your problem(s). Organisations we share your data with must store and use your data in line with data protection law.
How Long We Keep Your Data For
National Citizens Advice is responsible for managing any data in joint client case records. For more information please see their privacy notice.
| Data | Purpose | Retention |
|---|---|---|
| Personal Data, correspondence, and notes | Information about your query. | We keep your information for 6 years. If your case has been subject to a serious complaint, insurance claim or other dispute we keep the data for 16 years. |
Your Data Protection Rights
You have rights in relation to your personal data that we hold. Your rights include being able to request:
- Access to copies of your data
- Corrections are made to inaccurate data
- Deletion of your personal data
- Object to how we use your personal data
These rights are not absolute and may not apply in every circumstance. For more information about your rights you can visit the ICO website.
To make a data protection rights request you can do so by emailing admin@citizensadvicemt.org.uk.
Raising a Concern About How We Use Your Information
If you are concerned about how we have handled your personal information please contact us at admin@citizensadvicemt.org.uk.
You can also contact the national charity if you are unhappy with how we have used your personal data or wish to raise a concern about how a local office has handled your personal data. To do so you can email us at DPO@citizensadvice.org.uk.
Contacting the Information Commissioner’s Office (ICO)
You can also raise your concern with the Information Commissioner’s Office which regulates data protection law in the UK, if you are unhappy with how we have used your personal information. They will normally expect you to have made a complaint to us directly in the first instance.
Visit the ICO website.
Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Helpline number: 0303 123 1113
