Data Protection & Privacy
Citizens Advice Haringey complies with the Data Protection Act 2018 (the “Act”). For the purposes of the Act, Citizens Advice Haringey is the Data Controller.
Citizens Advice Haringey is committed to safeguarding your privacy, while providing a high quality of service. Citizens Advice Haringey will treat your personal information as confidential and your details will not be given or sold to anyone.
We will use the information collected online to help us understand more about how our site is used by visitors, and to develop and enhance our services to you.
Privacy Notice:
This privacy policy sets out the standards you can expect when we ask for or record your personal information, and explains how we’ll use it.
When we handle and store our clients’ personal information we follow the law, including the Data Protection Act 1998.
When we ask you for personal information we will:
- Explain why we need it
- Only ask for what we need
- Treat it as confidential
When we record and use your personal information we will:
- Only access it when we have a valid reason to do so
- Only share what is necessary and relevant
- Protect it and make sure nobody has access to it who shouldn’t
- Not sell it to commercial organisations
When we share your personal information with another organisation we will:
- Ensure that this is only done with your permission, or if we’re required to do so by law
- Follow the ICO Data Sharing Code of Practice to ensure the other organisation treats your information with the same level of care that we do
All staff and volunteers who handle personal information are given training and we take it very seriously if someone fails to use or protect it properly.
If you’re unhappy with how we record and use your information you should follow our complaints procedure. Full details of the procedure are available on request.
Please let us know as soon as possible if anything relating to your contact details or issue changes, which may affect the information we hold.
How we use your personal information:
Data controller: Citizens Advice Haringey, 20E Waltheof Gardens, London, N17 7DN. We collect and use information about you to help solve your problems, improve our services and tackle wider issues in society that affect people’s lives.
We always let you decide what you’re comfortable telling us, explain why we need your information and keep it confidential. When we keep something you tell us, we:
- only access it when we have a good reason
- only share what is necessary and relevant
- don’t sell it to commercial organisations
How will you use my data?
First and foremost your information will be used to provide you with advice. We also use information in a way that doesn’t directly identify you, to understand how different problems are affecting society and to take action to tackle these problems. As this is used for research it is kept separate from your case.
Do I have to give my consent for you to use information about me?
You can decide exactly what information you are happy to tell us. We’ll use the information because we have a ‘legitimate interest’ and have grounds of “substantial public interest” do so for the purpose of providing you with advice and carrying out research. Please see the table below:
| Purpose | Personal data
(UK GDPR Article 6 requirement) |
Special category and criminal offence data (UK GDPR Article 9 or 10 requirement) | Opt in/out required? |
|---|---|---|---|
| Advice, information and guidance provision | Article 6(1)(f) – Legitimate interests
Where processing is not based on any public function. We have carried out a Legitimate Interests Assessment for this processing. Article 6(1)(e) – Public task Where processing is based on official authority laid down by law or a statutory function. For example in relation to our consumer service functions. |
Article 9(2)(f) – establishment, exercise or defence of legal claims
Where the processing relates to the establishment or defence of legal claims including legal rights including but not limited to those such as those in relation to benefits, debt, energy and housing. For criminal offence data the same provision is outlined in Data Protection Act 2018, Schedule 1, Part 3 (33). Article 9(2)(g) – substantial public interest (statutory) Where our advice, information or guidance relates to a statutory function, such as in our consumer service we rely on Data Protection Act 2018, Schedule 1, (6) ‘Statutory etc and government purposes’. This condition also applies to criminal offence data Article 9(2)(g) – substantial public interest (confidential counselling, advice or support) Where our advice, information or guidance relates to confidential wellbeing support. For example if supporting a client with issues relating to loneliness. The specific substantial public interest condition we rely on is in Data Protection Act 2018, Schedule 1, (17) ‘Counselling etc’. This condition also applies to special category data and criminal offence data. NB: there may be locally managed services which could rely on alternative lawful conditions for processing. The IG Team can assist with considerations on a case by case basis. |
No, though clients may have the option of being unnamed |
| Witness support | Article 6(1)(f) – Legitimate interests
We have carried out a Legitimate Interests Assessment for this processing. |
Article 9(2)(g) – substantial public interest
Collection of SCD or criminal offence data is not usually necessary for this purpose but where it is we rely on the following provisions: For the purpose of administration of justice we rely on Data Protection Act 2018, Schedule 1, (7). Where we are providing emotional or wellbeing support we rely on is in Data Protection Act 2018, Schedule 1, (17) ‘Counselling etc’. This condition also applies to criminal offence data. |
No |
| Funder sharing | This will be dependent on the purpose the funder is processing data for and will need to be determined on a case by case basis.
Check with the funder and the relevant guidance. |
As per A.6 requirement | Case by case depending on purpose the funder is using the data for – check with funder |
| EDI monitoring | Article 6(1)(f) – Legitimate interests
We have a legitimate interest in processing EDI data to ensure we are promoting equity and diversity in our service. We have a full legitimate interest assessment for this processing. |
Article 9(2)(g) – substantial public interest
Processing of information relating to race or ethnicity, religious or philosophical beliefs, health (including disability), and sexual orientation for the purpose of enabling , promoting or maintaining equality of treatment. Specifically we rely on is in the Data Protection Act 2018, Schedule 1, (8) ‘equality of opportunity or treatment’. This substantial public interest category only applies to specific SCD criteria listed above and does not extend to criminal offence data. However criminal offence data is not processed for EDI monitoring. |
Yes, clients and witnesses should be given the option of providing this data including ‘prefer not to say’ options |
| Accessibility and reasonable adjustments | Article 6(1)(c) – Legal obligation
We have legal obligations in accordance with the Equality Act 2010. |
Article 9(2)(g) – substantial public interest
Specifically we rely on Data Protection Act 2018, Schedule 1, (6) ‘statutory and governmental purposes’ in accordance with the Equality Act 2010. This will only apply to special category data and will not extend to criminal offence data but such data is not processed for this purpose. |
Yes, clients can choose whether they provide this data or not |
| Statistical purposes and research (including feedback) | Article 6(1)(f) – Legitimate interests
We have a legitimate interest to carry out statistical analysis and research using our client data. We have carried out a legitimate interest assessment for statistical processing, research and policy formation. We may also keep pseudonymised data for archival purposes. |
Article 9(2)(j) Archiving, research and statistics
As per the A6 condition. |
Generally not required unless it involves client contact in which case an opt in should be offered |
| Direct marketing of Citizens Advice Services | Article 6(1)(f) – Legitimate interests
We have a legitimate interest to carry out marketing of our services to clients provided the service is in their best interest and we have been transparent and have provided opt outs unless this involves direct electronic marketing. Article 6(1)(a) – Consent If direct electronic marketing is involved we must get the client’s consent with a genuinely free and fair choice. |
SCD should generally not be processed for this purpose. | Yes, or consent |
| Publication of client stories | Article 6(1)(a) – Consent
Where we seek to publish client stories in an identifiable format, we will always get client consent. Clients will always be given a genuinely free and fair choice. NB: If fully deidentified a lawful basis is not required for publication itself – care must be taken to ensure they cannot be re-identified. |
Article 8(a)(a) – Explicit Consent
As per the A6 condition. |
Consent should be used if clients are identifiable |
| Maintaining quality and standards | Article 6(1)(f) – Legitimate interests
We have a legitimate interest as an organisation to ensure that we are meeting appropriate quality and standards in our advice to clients. |
Article 9(2)(f) – establishment, exercise or defence of legal claims
Citizens Advice needs to be able to provide evidence that certain standards and quality measures are being met so as to defend against claims of malpractice or negligence. Article 9(2)(g) – substantial public interest Specifically we rely on is in Data Protection Act 2018, Schedule 1, (11) Protecting the public against dishonesty etc where we are carrying out functions to protect against:
|
No |
| Complaints | Article 6(1)(f) – Legitimate interests
We have a legitimate interest to investigate complaints and to implement lessons learned from them. |
Article 9(2)(f) – establishment, exercise or defence of legal claims
Citizens Advice needs to be able to investigate complaints to defend against claims of malpractice or negligence. Article 9(2)(g) – substantial public interest Specifically we rely on is in Data Protection Act 2018, Schedule 1, (11) Protecting the public against dishonesty etc where we are investigating complaints in order to protect against:
|
No |
| Legal claims | Article 6(1)(f) – Legitimate interests
We have a legitimate interest in defending our organisation against legal claims. |
Article 9(2)(f) – establishment, exercise or defence of legal claims
We need to be able to adequately defend our organisation against legal claims. |
No |
| Individual rights requests | Article 6(1)(c) – Legal obligation
We have a legal obligation to carry our individual rights requests in accordance with data protection law. |
Article 9(2)(g) – substantial public interest
Specifically we rely on is Data Protection Act 2018, Schedule 1 (6) ‘statutory and governmental purposes’ to comply with the UK GDPR and Data Protection Act 2018. |
No |
| Safeguarding | Article 6(1)(e) – Public task
The legislation covering safeguarding is the Care Act 2014 (England) and the Social Services and Wellbeing (Wales) Act 2014. These acts put duties on local authorities in relation to adult safeguarding and while they don’t apply to us directly as a charity, we acknowledge Citizens Advice may receive their funding or are contracted to deliver services on their behalf and therefore it’s essential that we understand our role in protecting adults at risk. |
Article 9(2)(g) – substantial public interest
This condition is met when the processing is necessary for the safeguarding of children and of individuals at risk in accordance with Data Protection Act 2018, Schedule 1, (18) ‘Safeguarding of children and of individuals at risk’ |
No |
| Fraud prevention | Article 6(1)(f) – Legitimate interests
We have a legitimate interest in defending against fraudulent activity. Article 6(1)(c) – Legal obligation In some circumstances there are legal obligations to disclose actual or suspected cases of fraud. |
Article 9(2)(g) – substantial public interest
We rely on three separate substantial public interest conditions as follows: Data Protection Act 2018, Schedule 1, (10): ‘preventing and detecting unlawful acts’ – where we process data to prevent or detect such activity Data Protection Act 2018, Schedule 1, (14) : ‘Preventing Fraud’ where we disclose fraudulent activity to anti-fraud organisations Data Protection Act 2018, Schedule 1, (15) : ‘Suspicion of terrorist financing or money laundering’ to comply with certain requirements under Terrorism Act 2000 and Proceeds of Crime Act 2002 |
No |
| Responding to an life threatening emergency | Article 6(1)(d) – Vital interests
Where a person’s life may be in danger |
Article 9(2)(g) – Vital interests
Where a person’s life may be in danger and use of special category data is necessary. Data Protection Act 2018, Schedule 1, (30): ‘Protecting individual’s vital interests’ also enables criminal offence data for this purpose. |
No – should only be used where a person cannot consent to this processing |
Where will you store my data?
The record of your case will be stored securely in an electronic case management system used jointly by all of the Citizens Advice service. We are responsible for keeping it safe. As part of solving your problem, we might make written notes, download copies of your case or send e-mails containing your information. We will make sure any information is stored securely and only accessed when there’s a good reason by staff and volunteers by the Citizens Advice service.
How long will you keep my data?
We keep your case records for 6 years, before disposing of it securely. We may keep certain case records for 16 years if the advice given could have serious consequences if it was not stored for a longer period.
Why might you share my personal information? Who might you share it with?
We will generally not share information without your permission, unless required to do so by law or in some very limited situations, like to protect you or someone else from serious harm. If a particular service involves sharing your data without your permission, we will always let you know upfront that it isn’t confidential. In most cases we will share your data for the following reasons:
- To help progress your enquiry we may need to ask questions or negotiate with other agencies connected with your case.
- Sometimes we may suggest that we refer you to another agency for advice because they will be better able to help you with your problem.
- If you’ve given us permission to share your details with a Funder of our service, we may share your personal data with them so they can monitor the effectiveness of the service we provide you.
- The Citizens Advice service would like to contact you to find out if you were satisfied with the service you received or for your comments about your experience of our service. The Citizens Advice service may use a trusted research organisation to help them to do that. For this we need to share your contact details.
What data protection rights do I have?
From 31 January 2020 the United Kingdom General Data Protection Regulations (UK GDPR) came into force which give you further rights: to request we change any incorrect or incomplete data; to request we delete or stop processing your data; to obtain a copy of your data on request (you can do this by making a subject access request, which in most cases will be free of charge). If you believe we have not complied with your data protection rights you can complain to the Information Commissioner.
Citizens Advice Haringey is fully committed to compliance with the requirements of the Data Protection Act (DPA) 2018 and the United Kingdom General Data Protection Regulation (UK GDPR).
Complaints handling procedure Citizens Advice Haringey has a complaints handling procedure. Full details of the procedure are available on request.
Email security and website forms
When you provide Citizens Advice Haringey with personal information, for example, when using the feedback form or referral form, we take steps to ensure that your information is processed securely.
Citizens Advice Haringey makes every effort to ensure the security and integrity of emails on our systems. Unfortunately, no data transmission over the internet can be guaranteed to be 100% secure. As a result, while we strive to protect your personal information after we’ve received it, Citizens Advice Haringey cannot ensure or guarantee the security of information when it is being transmitted.
Note: This privacy policy section only covers this website citizensadviceharingey.org.uk and it’s subdomains; other websites linked from this website are not covered by this policy. Once you have accessed another website via one of our links you will be subject to the security and privacy policy of that site.
Cookies:
By using the Citizens Advice Haringey website you are confirming that you are happy to accept our use of cookies. Here you can find out more about how we use them.
What are cookies?
Cookies are small, harmless files placed on your computer’s hard drive or in your browser memory when you visit a website.
What do cookies do?
Cookies help to make the interaction between users and websites faster and easier. For example, they can remember your preferences for selected text resizing style, contrasts and even language selection. What cookies don’t do is store any personal or confidential information about you.
Are cookies safe?
Yes, cookies are harmless text files. They can’t look into your computer or read any personal information or other material on your hard drive. Cookies can’t carry viruses or install anything harmful on your computer.
We use track aspects of user visits, including the length of a user’s visit, their browser, geographic location and the use of the search facility on this website. Below is a list of the cookies we use:
| Cookie category | Cookie owners | Purpose |
| Website visit information | Google Analytics
Yoast SEO |
Google Analytics and Yoast SEO uses cookies to help us to track which pages are accessed. This allows us to understand how popular our site is and record visitor trends over time. The cookies contain no personally identifiable information but some of them do use your IP address to help determine where in the world you are accessing the site from and to track pages you visit within the site. |
| Social media | Facebook |
Enables users to share our webpages across Facebook and Twitter. |
| E-privacy | Citizens Advice Haringey | To help our site remember not to re-show the cookie message once a visitor has clicked ‘Don’t show this message again’. The cookie is currently set for 12 months, after which the message will reappear. Turns the cookie message off when a visitor clicks through to another Citizens Advice Haringey page. If a visitor closes their browser session and then returns to the site, the message will reappear. |
For more information on Google Analytics tracking: http://code.google.com/apis/analytics/docs/concepts/gaConceptsCookies.html
How you can manage or delete cookies
If you don’t want to receive cookies, you can change settings in your web browser so that your browser tells you when cookies are sent to it or you can refuse cookies altogether. You can also delete cookies that have already been set.
If you wish to restrict or block web browser cookies, the Help function within your browser should tell you how. Alternatively, these sites can provide more information on how to do this: