Privacy Policy

Privacy Notice

Last reviewed: June 2025

Introduction

East Dunbartonshire Citizens Advice Bureau (CAB) is a registered Data Controller with the
Information Commissioner’s Office (ICO). Our registration number is Z7905244.
This Privacy Notice describes how we collect and process the personal data of people who engage
with our Bureau. It also explains people’s rights and how to contact us.
Please send any questions about how we use personal information to
bureau@eastdunbartoncab.casonline.org.uk

About Us

Citizens Advice Bureaux in Scotland along with Citizens Advice Scotland form Scotland’s largest
independent advice network. We are charities working across Scotland. Our advice is available to
everyone and is free, independent, confidential and impartial. We also advocate for changes to
legislation and social policy that will improve people’s circumstances locally and across Scotland.
The Bureau is a member of the Scottish Association of Citizens Advice Bureaux (operating as Citizens
Advice Scotland or CAS), a network of 59 individual Citizens Advice Bureaux. Bureaux use a case
management system called CASTLE and are Joint Controllers for the personal data held on systems
managed by CAS. You can find more information on the CAS Privacy Notice.

Information we collect about you

Personal data is any information that identifies or relates to a specific person. This may include:
• Personal details such as name, contact information, and date of birth
• Details about your enquiry
• Information about your circumstances such as financial circumstances, benefits you receive,
employment and housing status
• Demographics data that you provide us with
• If you have agreed to be contacted for feedback or communications
• Personal data of people in your household, for example, if you have children or are a carer
• If someone is seeking advice on your behalf, we may collect their details too
• Details of your donation, if you donate to us
We may also collect special category data or other sensitive information when necessary:
• information that may inform the advice we provide, such as health conditions
• Demographics data that you provide us with
• criminal activity data that may inform the advice and support we provide
If you do not want us to keep a record of the advice we provide, we can help you as best we can, but
advice will be limited and general rather than specific to your circumstances.

How we collect your information

We may collect your information:
• When you contact us including in person, by phone, videocall, webchat, email, letter or
through our website
• From systems we use to support our work, such as appointment booking systems
• When you, or a third party, provides us with documentation
• From an organisation that referred you
• From someone acting on your behalf
• When you complete a survey or provide us feedback
• on CCTV when you attend our premises
• via cookies on our website
• when you make a donation to us, including through fundraising sites, such as JustGiving
We use social media to raise awareness of our services and promote our impact, and we are
occasionally contacted this way with queries. To protect your personal information, we encourage
you to contact us via other methods and we will seek agreement from you to transfer your personal
information from social media to our systems.

How we use your information

We may use your information to:
• Contact you to support with your enquiry and explain how we can help
• Keep a record of our conversations and actions to inform your advice and support needs
• Support you in accessing our services, such as through British Sign Language or
interpretation services
• Keep records for audit, standards, and insurance purposes
• Share information with other organisations, such as for referrals
• Report statistics or anonymised case studies to funders
• Develop and improve our services
• Manage donations
• Send communications
• Ask for your feedback on our services
We may also use your data to monitor the issues that are impacting the people we help. This informs
our work advocating for changes to legislation and social policy. We do this through data analysis;
however, we may use your experiences to inform our case studies. These will be anonymised.
Occasionally we may ask to share your story to bring awareness to an issue, we will only do this
when you have given consent.
Our lawful basis for using your information
We only process your personal data when there is a lawful basis for us doing so. We may rely upon:
• legitimate interests, such as for maintaining records of advice and support, to defend legal
claims, and to maintain a high-quality service
• public task, when we are delivering a statutory service
• legal obligation, when we need to process your data to meet a legal obligation
• your consent, such as when we contact you for feedback or refer you to another support
organisation
Where we process special category data (such as health information), we may rely upon:
• substantial public interest conditions
• defence of legal claims
• archiving, research and statistics
• your explicit consent

When relying on substantial public interest conditions in Schedule 1 Part 2 of the DPA 2018 we are
required to have an Appropriate Policy Document in place.

Who we share your information with

We only share your personal data when necessary and in line with data protection laws.
• if we need to share your information with CAS or other Bureaux
• with professional advisors such as insurers and legal professionals
• with auditors to maintain standards, such as for CAS Membership Standards audits, or with
the Scottish Legal Aid Board (SLAB) for Scottish National Standards accreditation
• with funders as part of audit and compliance, or for research and reporting purposes. We
anonymise this where possible
• to meet any legal and regulatory obligations
• If we use external service providers, we put in place contracts to ensure they follow data
protection rules
We may share information with the following, only when you have consented:
• If we refer you to another organisation for support
• If someone is acting on your behalf, we may share your information with them when
necessary
• If we engage with an organisation on your behalf, we may have to share information with
them
• with funding partners to obtain feedback on our service provision
• with HMRC if you make a Gift Aid declaration as part of your donation
In exceptional circumstances, where there is a high risk of harm to an individual, information may be
shared with third parties. We have strict Safeguarding procedures in place for when this may occur.

Will we share your information outside of the UK?

We only store personal data in the UK or the EU.
However, some of our suppliers may be based in other countries. If we need to share your data with
these companies, we take steps to make sure your data is protected.

How long we keep your information

We will only keep your data for as long as is necessary. For most people we keep your data for a
maximum of seven years. This is from the point of last contact. We keep recordings of phone calls
for two years.
In certain circumstances we are required to keep records for longer, for example, if you have
arranged a debt remedy solution, your records are kept for the duration this is active.
In rare cases, we might keep your data for longer if there is a legal reason, such as an on-going
complaint or legal case.

National Projects

National Projects are projects delivered by Bureaux across the Citizens Advice Network and managed
by CAS. Where you seek support from one of these projects, you may receive advice from an adviser
based in a Bureaux somewhere else in Scotland. Some projects have a Privacy Notice which
supplements this one, these are linked below:
• Patient Advice and Support Service Scotland (PASS)
• Pension Wise
Your rights
You have rights over your personal data. Your query may be passed to the CAS Data Protection Team
to resolve.
You can:
• Request a copy of your personal information
• Ask us to update anything that’s no longer accurate
• Request that we delete your personal data. There are some exceptions, and we may need to
keep some of your data, for example to defend legal claims
• Object to how we use data in some situations
• Withdraw your consent

We do not use any automation or profiling to make decisions.
If you’re unhappy with how we have handled your data, you can complain to the Information
Commissioner’s Office at ico.org.uk.
Last updated: June 2025