Privacy Policy

Privacy Notice

Glasgow Castlemilk CAB

Glasgow Castlemilk CAB (also referred to as ‘the Bureau’, ‘we’, ’our’, or ‘us’) is the Data Controller for any personal data we process about you for the purposes set out in this Privacy Notice. Our ICO registration number is Z870814X.

This notice outlines what personal data the Bureau collects and processes about you when seeking advice and assistance from the Bureau. This notice does not cover personal data we process about our staff, workers, trustees, volunteers, supporters, or donors. Please read this notice carefully to understand how we process and look after your personal data.

The Bureau is a member of the Scottish Association of Citizens Advice Bureaux (SACAB – operating name Citizens Advice Scotland), a network of 59 individual Citizens Advice Bureau. The Bureau uses a case management system called CASTLE. We are a Joint Controller with Citizens Advice Scotland (CAS) for the personal data held on this system.

Our Data Processing

Glasgow Castlemilk CAB is an independent Bureau that provides free, confidential, expert advice and assistance to help you resolve your problems. We deliver a holistic service and our data processing may vary depending on the support we are providing. We only use the personal data we need. Most personal data we process will have been provided by you during your discussions with our advisors. On occasion, referrals are made to the Bureau from other organisations. They may share your personal data with us to help us provide you with advice and support. They should make you aware when this happens.

The Bureau processes personal data to keep records of the advice and support offered. This is to provide an effective and efficient service to you as well as for our insurance purposes. Personal data is any information that could be used to identify you. This may include:

• Name
• Address
• Email
• Phone number
• Financial data
• Criminal convictions data

You may also provide information such as your ethnicity, mental and physical health, political and philosophical beliefs, religion, trade union membership, genetics, sexual life, or gender. This is called ‘special category data’ and we will only use this type of personal data where it is necessary for us to deliver services to you and where we are permitted by law.

If you do not want us to record and use your personal data, we can help you as best we can, but advice will be limited and general rather than specific to your circumstances.

The Bureau may also gather personal data for purposes such as research and advocacy, more information on our purposes for processing data can be found in Appendix 1.

Lawful reasons we rely on to process your information

We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances where:

• It is necessary for our legitimate interests to meet the aims of our organisation but respecting your interests and rights.
• You have given us your consent to process your personal data.
• Processing is necessary for us to perform a public task carried out in the public interest as set out in law.

When we process special category personal data, in addition to the above legal reasons we may process your special category data if:

• We have obtained your explicit consent
• There is a substantial public interest for us to do so

Please see the table below at Appendix 1 for further information on the lawful bases we may rely upon to process your personal data.

Withdrawing Consent

If we rely upon your consent to process your personal data, you may request to withdraw consent at any time by contacting us at which point we shall stop processing your personal data in that way. Please note that this does not affect the legality of our processing up to the date you tell us you want to withdraw your consent.

Sharing Your Personal Data

We may need to share your personal data in the following situations:

• When you give us authority to work with organisations on your behalf
• To refer you to other supporting organisations
• If we need to share your information with other Bureaux
• With third-party service providers delivering services for the Bureau (e.g. technology providers)
• With our professional advisors such as auditors, insurers, and legal professionals
• With funders as part of research and advocacy work
• With local authorities where relevant to inform policy and prioritise resources
• To meet our legal and regulatory obligations

If we do need to share personal data, we will have appropriate controls and processes in place through written contracts. Any data sharing will comply with data protection laws and where possible we will anonymise data prior to sharing it.

In exceptional circumstances where there is a high risk of harm to an individual, person-identifiable confidential information may be shared with third parties. We have strict Safeguarding procedures in place for when this may occur.

Transfers to third countries

We may transfer personal information outside the UK.

Some of our third-party service providers may process personal data we give them outside of the UK. If it is necessary to transfer your personal data outside the UK, then we will put in place additional measures to protect your personal data to ensure it remains protected.

Retention

We will not keep your personal data for any longer than we need it. All data will be securely disposed of once it is no longer needed.

Most client information is retained on our CASTLE system for 7 years, however under certain circumstances we are legally required to retain personal data for longer, for example if you have entered into a debt remedy your information is retained for up to 20 years.

Your Data Protection Rights

Under data protection law, you have a number of rights which you can contact us to exercise. These rights include:

• Right of access to the data we process about you
• Right to rectification of any data we process that may be incorrect
• Right to erasure of data we process about you
• Right to restrict processing of data we process about you
• Right to object to the Bureau processing your data
• Right to data portability
• Right not to be subject to automated decision-making and profiling

Your ability to exercise these rights depends on our reason for processing your personal data. Please contact manager@castlemilkcab.casonline.org.uk if you wish to make a request.

Data Controller Contact Details

If you have any questions or queries or wish to exercise your data rights you can contact the Bureau at 0141 634 0338. If you have queries regarding CASTLE, our case management system, you should contact the Bureau in the first instance, however your query may be passed to CAS as a Joint Controller of the system. You can find information on CAS’s data processing on the CAS Privacy Policy.

Supervisory Authority Contact Details

You have the right to lodge a complaint to the Information Commissioner about the processing of your data. Their contact details are:

Information        Commissioner’s        Office,        Wycliffe        House,        Water        Lane,        Wilmslow Cheshire, SK9 5AF. Tel: 0303 123 1113. The website is at: https://ico.org.uk.