When you get advice from an adviser - our privacy policy
We collect and use the details you give us so we can help you. We have a ‘legitimate interest’ to do this under data protection law. This means it lets us carry out our aims and goals as an organisation. We'll always explain how we use your information.
What information we ask for
We'll only ask for information that's relevant to your problem. Depending on what you want help with, this might include:
your name and contact details - so we can keep in touch with you about your case
personal information - for example about family, work, or financial circumstances, or if you're vulnerable or at risk of harm
details about services you get that are causing you problems - like energy or post
details of items or services you've bought and traders you've dealt with
information like your gender, ethnicity or sexual orientation
We occasionally ask for details about someone else like a neighbour or your partner so we can deal with an enquiry. We'll only do this if we have a legitimate interest in the information, or we need it to protect someone's life.
If you don't want to give us certain information, you don't have to. For example, if you want to stay anonymous we'll only record information about your problem and make sure you're not identified.
We’ll always ask for your consent to store information about your:
health conditions
ethnic origin
religion
trade union membership
sexual orientation
You can withdraw your consent at any time. Contact your local Citizens Advice and tell them what personal information you don't want us to store - we'll delete it.
We might ask your permission to contact you later with an online survey about your experience getting help from us. This is called the ‘Client Experience’ survey.
How we use your information
The main reason we ask for your information is to help solve your problem.We only access your information for other reasons if we really need to. Data protection law lets us do this as long as we either get your consent or we have a legitimate interest. For example we have a legitimate interest to access your data:
for training and quality purposes
to investigate complaints
to get feedback from you about our services
to help us improve our services
All advisers and staff accessing data have had data protection training to make sure your information is handled sensitively and securely.
Understanding people's problems
We use some information to create statistics about who we're helping and what problems are the most common. We might use the information you’ve told us and your answers to the Client Experience survey. This information is always anonymised - you can't be identified.
We share these with funders, regulators, government departments and publicly on our blogs, reports, social media and press releases.
The statistics also inform our policy research, campaigns, or media work.
We might use a research company to help us analyse the information. We have an agreement with them to make sure they store data securely and follow data protection laws. We’re still responsible for keeping your personal information safe and making sure we follow data protection law. This means we're the ‘data controller' for your information.
When we share your information with other organisations
With your permission, we might share your information with other organisations so we can:
help solve your problem - for example, if you ask us to contact your creditors we might need to share your name, address and financial details with them
refer you quickly to another organisation for more advice or support, if relevant
help you access certain services - for example food banks or Trading Standards
monitor the quality of our services
Organisations we share your data with must store and use your data in line with data protection law. They'll have their own privacy policies for how they handle your information and keep it safe.
There might be specific organisations we share your information with, depending on what service you access.
If you’re in Wales, we’ll use a system called Refernet if we need to refer you to another organisation - or if another organisation refers you to us.
If you’re referred through Refernet, your information will be stored securely on the Refernet system. We keep your information on Refernet for a year from the date you’re referred. After a year, your information is deleted.
If you get advice in person
NHS Test and Trace or local public health organisations might ask us to share your name, contact details and the date of your visit. This is to help track cases of coronavirus. We have a legitimate interest to share this information under data protection law.
We won’t:
share information about the reason for your visit
share your contact details with anyone other than Test and Trace or a local public health organisation
Unlike most situations, we won't ask for your consent before we share your contact details. If you don't want us to share this information you can tell your local office you want to opt out. If you don’t want to give us your contact details at all, we’ll still be able to give you advice in person.
NHS Test and Trace might contact you if you visited at the same time as someone who tested positive for coronavirus. You can:
find out more about Test and Trace in England on GOV.UK
find out more about Test and Trace in Wales on the Welsh Government website
If you have the NHS Test and Trace app on your phone you can ‘check in’ at some of our local Citizens Advice offices. You can still get advice even if you don’t check in on the app. You can:
If you need a food bank voucher
We’ll ask your permission to share your information with the Trussell Trust - they run food banks across the country. You can check the Trussell Trust’s privacy policy on their website.
If your adviser applies to the 'Breathing Space' scheme to protect you from your creditors
We’ll share your information with the Insolvency Service if you decide to enter a Breathing Space. The Insolvency Service will store your contact details and information about your debts on their online Breathing Space system. Your creditors will be able to see your information on the system, but only for debts you owe to them.
If you're the client of a different advice charity and used the Debt Advice Project
Your personal information is shared securely with us from the charity you got advice from. They should get your permission then send us the information. We then share some information with the Money and Pensions Service, our funder, as part of our regular reporting.
This information includes:
your name, contact details and postcode
your demographic information - like your age, gender and ethnicity
your employment and housing status
your income and debts
what kind of advice you got and the outcome
if you were referred to another organisation
The charity you got advice from will have their own policy on how they use, store and share your data.
If you used our debt advice service before 1 January 2019
When you got debt advice from us we might have shared your personal information with our funder, the Money Advice Service. We did this with your permission so they could check the quality of our advice.
From 1 January 2019, a new Single Financial Guidance Body was formed by merging the Money Advice Service, Pension Wise and The Pensions Advisory Service.
As a result, the Money Advice Service has transferred your personal information to the:
Single Financial Guidance Body - if you live in England
Department for Communities (DfC) - if you live in Northern Ireland
Welsh government - if you live in Wales
These organisations must store and use your personal information in line with data protection law - they can't pass it on or sell it without your permission.
If we're concerned about your or someone else's safety
If something you've told us makes us think you or someone you know might be at serious risk of harm, we could tell the police or social services - for example if we think you might hurt yourself or someone else.
Storing your information - if you contact us online, by phone or face to face
Whether you get advice face to face, over the phone, by email or chat, our adviser will log all your information, correspondence, and notes about your problem into our secure case management systems. We have a ‘legitimate interest’ to do this under data protection law. This means it lets us carry out our aims and goals as an organisation.
Some of your information might also be kept within our secure email and IT systems.
If an adviser needs to see your documents, they might tell you how to upload copies of the documents to a secure online system. The adviser will then move the documents from the online system to our case management system.
We keep your information for 6 years. If your case has been subject to a serious complaint, insurance claim or other dispute we keep the data for 16 years.
If you use the Extra Help Unit, we keep your information for 3 years from when we close your case.
Our case management systems are hosted within the EEA and wherever possible, the UK. Most of our trusted partners store their data securely within the European Economic Area (EEA) in line with data protection law.
There might be other places we store your information, depending on how you accessed our advice.
If you contact us for chat or email advice
We'll store your chat transcript or email advice request form in our case management systems - this is kept for 6 years.
In most cases, the transcript or email form's also stored in an online system run by our trusted partner LivePerson.
LivePerson will delete all the data after 13 months.
Our chat advisers can see this information when they chat with you, but it isn’t copied to your case record.
We use this data to improve the advice we give you. We also use it to research the needs of our users. This helps us make sure people in different areas and using different devices and systems can use our website and chat service.
Our chat system records anonymised statistics so we can track chat usage and performance. This data doesn't contain your personal information.
The data in our chat system is stored securely within the European Economic Area (EEA) in line with data protection law.
You can ask for a copy of your chat to be securely emailed to you. The sender of the email will be transcripts@citizensadvice.org.uk.
Any emails between you and your adviser are only stored within the local Citizens Advice office email system where the adviser is based. The local Citizens Advice should have their own policy for how they keep these emails secure.
If you tell us sensitive details about yourself, we’ll ask for your permission to use and store them. This includes your:
health conditions
ethnic origin
religion
trade union membership
sexual orientation
If you use the Extra Help Unit, emails between you and your adviser are held on the Servicemail database and deleted 3 years after we close your case.
If you get advice over the phone
If you call us, we'll record the conversation for training and monitoring purposes. When you call, you'll hear a recorded message telling you how we use and store your information - you can let the adviser know if you disagree.
Calls are recorded by our trusted partner, stored within the UK or EEA, and processed in line with UK data protection law. Recordings are usually held for 6 months and then deleted.
On rare occasions it may be necessary to process data outside of the EAA, where this applies the lawful and relevant data protection safeguards are in place.
If you agree to get appointment reminders by text message (SMS)
If you give us permission, we might send you text messages (SMS) to remind you when you’ve got an appointment soon.
If we send you a message it will contain the date, time and location of your appointment. It might also include some personal details about you, like your first name, so you know the message is from Citizens Advice.
We use a system called Notify to send text messages. Notify stores any messages it sends for 7 days then deletes them automatically. You can check how Notify keeps your data secure on GOV.UK.
We’re responsible for keeping your personal information safe and making sure we follow data protection law. This means we're the ‘data controller’ for your information.
If you get advice by Skype or an app like WhatsApp
Your local Citizens Advice should have their own policy that covers how they store your information through these channels. Contact your local Citizens Advice and ask to see the policy - or check their website.
If your adviser refers you to another Citizens Advice Service
Some other Citizens Advice services store and share your information in different ways.
If your service isn't listed here, there's nothing extra we need to tell you.
If you've been referred to the Citizens Advice consumer service, find out more about how they use, store and share your personal information.
If you've been referred to the Citizens Advice Debt Relief Order (DRO) Team, find out more about how they use, store and share your personal information.
If you've been referred to the Citizens Advice Witness Service, find out more about how they use, store and share your personal information.
If you've been referred to Pension Wise, find out more about how they use, store and share your personal information.
Contact us about your information
You can contact us at any time and ask us:
what information we've stored about you
to change or update your details
to delete your details from our records
If you know the local Citizens Advice you've been dealing with, please contact them directly about information they hold about you.
If you don't know which charity you dealt with, contact your local Citizens Advice and ask them to check your case records to find out.
If you want to make a complaint
If you're not happy with how we've handled your data, you can make a complaint.