Privacy Policy

At Citizens Advice Somerset, we collect and use personal information to help solve problems, improve our services and tackle wider issues in society that affect people’s lives.

This privacy policy explains how we use your information and what your rights are. We handle and store your personal information in line with data protection law and our confidentiality policy. This is our appropriate policy document.

The following pages tell you more about how we use your information in more detail.

Our network

Citizens Advice is a membership organisation made up of the national Citizens Advice charity and many local offices across England and Wales, including Citizens Advice Somerset.

Citizens Advice Somerset is an independent charity and a member of the national Citizens Advice charity.

All members of the Citizens Advice network are responsible for keeping personal information safe and making sure data protection law is followed.

Members of the network also run some jointly designed services and use some of the same systems to process your personal data. In these instances we are joint data controllers for these activities.

Jointly controlled data

All offices in the Citizens Advice network use some joint systems to carry out our activities. These include joint case management systems, telephony platforms and more.

Staff from a different local Citizens Advice can only access your personal information in a joint system if they have a good reason. For example when:

• you go to a different office to seek advice
• more than one office is working together in partnership
• they need to investigate a complaint or incident

We have rules and controls in place to stop people accessing or using your information when they shouldn’t.

Tell an adviser if you’re worried about your details being on a national system. We’ll work with you to take extra steps to protect your information – for example by recording your problem without using your name.

National Citizens Advice has a privacy notice available on their website that covers general advice and nationally managed systems, including our case management systems. This policy covers the processing we carry out in our office.

How we use your data for advice

This section covers how we use your data to provide you with advice.

For general advice and nationally funded advice programmes please see the national Citizens Advice privacy notice.

All advisers and staff accessing data have had data protection training to make sure your information is handled sensitively and securely.

How we collect your information

In addition to the above linked general advice information, we also collect personal data in the following ways:

• an email advice request form
• online referral form from other organisations supporting you
• application forms e.g. for food help or local support scheme applications
• letters you send us

What information we collect

In addition to the above linked general advice information, we may also collect:

• individual client feedback e.g. wellbeing or confidence data.

What we use your information for

The main reason we ask for your information is to help solve your problem. But we also use it for:

• training and quality purposes
• to investigate complaints
• to get feedback from you about our services
• to help us improve our services.

Our confidentiality policy

At Citizens Advice we have a confidentiality policy which states that anything you tell us as part of advice will not be shared outside of the Citizens Advice network unless you provide your permission for us to do so.

There are some exceptions to this such as needing to share:

• to prevent an immediate risk of harm to an individual
• in select circumstances if it is in the best interests of the client
• where we are compelled to do so by law (e.g. a court order or meeting statutory disclosures)
• where there is an overriding public interest such as to prevent harm against someone or to investigate a crime
• to defend against a complaint or legal claim
• to protect our name and reputation for example to provide our side of a story reported in the press.

Who we share your information with

With your permission, we might need to share your details with:

• Housing provider – to help resolve a housing issue
• Creditors – to get more information about your debts.
• Credit reference agencies – to get a copy of your credit report.
• Employers or benefits offices – to get details about your income or help resolve a dispute
• Some other organisation – to refer you for further help.

We’ll share your information with the Insolvency Service if you decide to enter a:

• Breathing Space – The Insolvency Service will store your contact details and information about your debts on their online Breathing Space system. Your creditors will be able to see your information on the system, but only for debts you owe to them.
• Debt Relief Order – The Insolvency Service will store your contact details and information about your income, expenditure and debts on their system.

If you need a food bank voucher we will ask your permission to share your information with your local food bank.

You can see the local food bank policies on their websites:

• Trussell’s privacy policy
• Fair Frome’s privacy policy
• Lord’s Larder privacy policy
• Salvation Army privacy policy

Our lawful basis for using your information

• Where the processing relates to the establishment or defence of legal claims including legal rights including but not limited to those such as those in relation to benefits, debt, energy and housing.
• Where our advice, information or guidance relates to confidential wellbeing support. For example if supporting a client with issues relating to loneliness.
• We have a legitimate interest as an organisation to ensure that we are meeting appropriate quality and standards in our advice to clients.
• We need to be able to provide evidence that certain standards and quality measures are being met so as to defend against claims of malpractice or negligence.
• Where processing is based on official authority laid down by law or a statutory function.
• We have legal obligations in accordance with the Equality Act 2010.
• We have a legitimate interest to investigate complaints and to implement lessons learned from them.
• We also carry out functions to protect the public against:
  • dishonesty, malpractice or other seriously improper conduct
  • unfitness or incompetence,
  • mismanagement in administration.

How we use your data for research, feedback and statistics

This section covers how we use your data to carry out our research, feedback and statistical work.

National Citizens Advice covers their use of data for this purpose in their privacy notice.

How we collect your information

The data we collect for research, feedback and statistics is not identifiable outside of the Citizens Advice service.

What information we collect

We may collect the following information:

• Location
• Age
• Gender
• Sexual orientation
• Racial or ethnic origin
• Household type
• Housing status
• Employment status
• Advice issues codes

What we use your information for

We collect information about our clients:

• backgrounds to make sure we are delivering our services in an equitable way and not excluding any groups from our services.
• experience of our services so we can learn and improve.
• injustices or unfairness experienced so we can campaign for change.

Who we share your information with

We may use your data for ‘client stories’ (case studies), in impact reports shared with our funders, on social media, or in our campaign work.

We do not share any of your identifiable data without your permission. We anonymise or aggregate any research, feedback and statistical data before we use it or share it.

Our lawful basis for using your information

• We have a legitimate interest in processing EDI data to ensure we are promoting equity and diversity in our service.
• Processing of information relating to race or ethnicity, religious or philosophical beliefs, health (including disability), and sexual orientation for the purpose of enabling , promoting or maintaining equality of treatment.
• Where we seek to publish client stories in an identifiable format, we will always ask your permission. Clients will always be given a genuinely free and fair choice.

How we use your data for fundraising and donations

This section covers how we use your data to carry out our fundraising activities.

National Citizens Advice covers their use of data for fundraising in their privacy notice.

How we collect your information

Our donation platform is hosted by a third-party supplier called JustGiving. They collect information on our behalf to process your donation and they store it securely.

They’ll only use your information to do the work we’ve asked them to and only if that information is relevant to the work they’re doing. They can’t give, sell or rent your personal information to anyone else for any reason. You can read JustGiving’s privacy policy.

We also receive donations directly from individuals in various formats e.g. letter.

When we put on or participate in a fundraising event we may take photographs or receive quotes from participants.

What information we collect

When we receive a donation, either directly or via JustGiving the following data is collected and stored:

• data to identify you, such as your name and date of birth – for example, if you make a donation
• your contact details, such as email address, postal address and phone number – for example, to be able to process a donation or claim Gift Aid
• financial data, such as your bank or card details – so that they can process your donation on our behalf
• records of your history with us, including transaction data, details of your donation.

In addition to the above we also use photograph’s, names and quotes for specific events or fundraising activities that we have organised ourselves. We will always ask your permission before using your name or image(s).

What we use your information for

• Promotion of charitable events and celebrating success
• Financial accounting e.g. reporting gift aid declarations

Who we share your information with

• On our website or social media or in printed publications, with your permission – promotion
• His Majesty’s Revenue and Customs – tax purposes

Our lawful basis for using your information

• Legal obligations – where processing is based on official authority laid down by law or a statutory function e.g. oncome and tax reporting to HMRC.
• Legitimate interest – our legitimate interests enable us to meet our charitable objectives.

How we use your data when applying to work or volunteer

How we collect your information

Volunteer applications are collected using a secure online Microsoft Form within Microsoft (M365).

Employees and Trustees complete a paper application form which is either completed and stored electronically within M365, or manually completed and scanned/uploaded to M365.

All other recruitment documentation or paperwork is either completed and stored electronically within M365, or manual completed and scanned/uploaded to M365.

What information we collect

• Name
• Address
• Contact information
• Accessibility information to enable us to make reasonable adjustments
• Education, qualifications and work history
• References
• Disclosure and Barring Service (DBS) information
• Proof of right to work in the UK
• Bank details
• Student loan details (if an employee is repaying one)

What we use your information for

• to check you’ve got the right skills for a role when you apply
• to ensure we have met our Equality Act obligations
• to arrange an interview
• contact you to tell you the result of your application
• send you an offer letter or contract
• appropriate role specific checks when we make an offer, for example contacting your references, checking your right to work in the UK, DBS check
• pay your expenses and/or wages

Who we share your information with

Where applicable to your role, we may share your information with:

• Your named references – recruitment suitability check
• HMRC – payroll and expenses
• Disclosure and Barring Service (DBS) – criminal record check
• Home Office – employer right to work checking service

Our lawful basis for using your information

• We have a legitimate interest as an organisation to ensure that we are recruiting, training and supporting our people.
• Processing is necessary for the purposes of carrying out the obligations in relation to employment and social security.
• Processing is necessary for the performance of a contract.
• Legal obligations in accordance with statutory obligations e.g. providing salary details to HMRC.
• Health and safeguarding duties, and obligations.
• Public health – such as protecting against serious cross-border threats to health e.g. pandemic.
• Where the processing relates to the establishment or defence of legal claims.

All volunteers and staff have access to our organisational policies which provide comprehensive information.

How we use your data when using our website

What information we collect

When you use our website we collect information from you such as location data, cookies, or personal information you give us through completing online forms e.g. advice query, local welfare support, volunteering application etc.

In our online forms, we collect:

• your name, address and contact information
• the answers you gave
• the detail about your contact with us support, grant application etc.
• the date and time you submitted the form.

How we collect your information

We use data called cookies to get information about how you’re using our website – for example, what pages you click on.

When using our online forms, your completed form comes through to our Microsoft mailboxes to enable us to record your advice need and respond.

What we use your information for

• Improving your experience of our website
• Providing advice or local assistance
• Recruitment
• Fundraising

Who we share your information with

Your information is stored in our website content management system and can only be accessed by Citizens Advice Somerset staff and Somerset Web Services who built and manage our website when there is a business need to do so – read Somerset Web Service’s privacy policy.

Our lawful basis for using your information

• We have legal obligations in accordance with the Equality Act 2010.
• Where processing is based on official authority laid down by law or a statutory function. For example in relation to our local social welfare provision.
• We have a legitimate interest to carry out statistical analysis and research using our client data. We may also keep pseudonymised data for archival purposes.
• We have a legitimate interest in defending our organisation against legal claims.
• Where the processing relates to the establishment or defence of legal claims including legal rights including but not limited to those such as those in relation to benefits, debt, energy and housing.
• Where our advice, information or guidance relates to a statutory function, such as in our local social welfare support provision.
• Where our advice, information or guidance relates to confidential wellbeing support. For example if supporting a client with issues relating to loneliness.

For recruitment purposes see the section above entitled “How we use your data when applying to work or volunteer” for full details of our lawful basis.

How we use cookies on our website

We use cookies to:

• make sure the website works well for you e.g. remembering your preferences
• making our online forms work
• find out how you’re using our website so we can improve it
• help us run fundraising campaigns effectively

For full details see read our cookie policy.

We use tools on our website that are delivered by other organisations, they might put cookies on your device when you use it. The tools and services we have on our website from other organisations are:

• Google maps and YouTube videos – read Google’s privacy policy
• Just Giving – read JustGiving’s privacy policy

How long we keep your data for

National Citizens Advice is responsible for managing any data in joint client case records. For more information please see their privacy notice.

Third party processors

Third party processors are other organisations that carry out data processing on our behalf. Third party processors don’t use data for their own purposes and we have agreements in line with data protection law.

Where personal data is stored or processed externally a data privacy impact assessment is undertaken and the ICO Cloud Computing guidance is followed.

Your data protection rights

You have rights in relation to your personal data that we hold. Your rights include being able to request:

• Access to copies of your data
• Corrections are made to inaccurate data
• Deletion of your personal data
• Object to how we use your personal data

These rights are not absolute and may not apply in every circumstance. For more information about your rights you can visit the ICO website.

To make a data protection rights request you can do so by emailing: [email protected].

Raising a concern about how we use your information

If you are concerned about how we have handled your personal information please contact us at [email protected].

You can also contact the national charity if you are unhappy with how we have used your personal data or wish to raise a concern about how a local office has handled your personal data. To do so you can email [email protected].

Contacting the Information Commissioner’s Office (ICO)

You can also raise your concern with the Information Commissioner’s Office which regulates data protection law in the UK. if you are unhappy with how we have used your personal information. They will normally expect you to have made a complaint to us directly in the first instance.

• Visit the ICO website.
• Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
• Helpline number: 0303 123 1113

This appropriate privacy policy document applies from 4 March 2025.