Citizens Advice East End Privacy Policy

Policy last reviewed 25 October 2023

At Citizens Advice we collect and use your personal information to help solve your problems, improve our services and tackle wider issues in society that affect people’s lives. You have a number of rights regarding your personal information:

The right to be informed about how we will use your personal data;
The right to access a copy of any personal data we hold about you;
The right to have personal data rectified if it is inaccurate or incomplete;
The right to request the deletion or removal of personal data;
The rights to restrict and object to processing of personal data;
The right to obtain and reuse your personal data for your own purposes;
Rights in relation to automated decision making and profiling;
The right to withdraw your consent for the processing of your personal data;
The right to lodge a complaint with us and/or the Information Commissioner’s Office.

We only ask for the information we need. We always let you decide what you’re comfortable telling us, explain why we need it and treat it as confidential.

When we record and use your personal information we:

Only access it when we have a good reason;
Only share what is necessary and relevant;
Don’t sell it to anyone.

At times we might use or share your information without your permission. If we do, we’ll always make sure there’s a legal basis for it. This could include situations where we have to use or share your information:

To comply with the law – for example, if a court orders us to share information. This is called ‘legal obligation’;
To protect someone’s life – for example, sharing information with a paramedic if a client was unwell at our office. This is called ‘vital interests’;
To carry out our legitimate aims and goals as a charity – for example, to create statistics for our national research. This is called ‘legitimate interests’;
For us to carry out a task where we’re meeting the aims of a public body in the public interest – for example, delivering a government or local authority service. This is called ‘public task’;
To carry out a contract we have with you – for example, if you’re an employee we might need to store your bank details so we can pay you. This is called ‘contract’;
To defend our legal rights – for example, sharing information with our legal advisers if there was a complaint that we gave the wrong advice.

We handle and store your personal information in line with the law – including the UK General Data Protection Regulation and the Data Protection Act 2018.

You can check our main Citizens Advice policy for how we handle most of your personal information.

This page covers how we, as your local charity, handle your information locally in our offices.

How we collect your data

We follow the national Citizens Advice privacy policy for collecting your data, with the following exception.

What information we ask for

See our national Citizens Advice privacy policy to find out what information we ask for.

How we use your information

See our national Citizens Advice privacy policy to find out how we use your information.

Working on your behalf

When you give us authority to act on your behalf, for example to help you with a Universal Credit claim or to request a Food Bank voucher, we’ll need to share information with that third party.

When we act on your behalf, we may share information with:

National government bodies, like the Department of Work and Pensions;
Tribunals and courts, like employment tribunals;
Your local authority: London Borough of Hackney, London Borough of Tower Hamlets, London Borough of Newham;
Food Banks such as the Trussell Trust;
Fuel voucher providers such as Charis or the Fuel Bank Foundation;
Charities that award small grants for household items;
Your housing association, such as Clarion Housing Group, Hackney Homes, L&Q, Poplar Harca;
Your creditors;
Solicitors acting on your behalf pro-bono (without charging a fee), such as Chris Solicitors, Edwards Duthie Solicitors, Whitechapel Legal Advice Centre (WLAC).

How we store your information

If you are a client of Citizens Advice East End

The national Citizens Advice charity and Citizens Advice East End operate a system called Casebook to record information relating to the advice we give you.

Citizens Advice East End uses Microsoft Office 365 for services such as email and IP telephony, and productivity tools such as Microsoft Teams, Microsoft Word, or Microsoft Excel. By providing this service, Microsoft is working as our data processor. You can find out more about how Microsoft carries out that role.

If you tell us that you want to receive information by text message, Citizens Advice East End uses VoodooSMS to send you text messages. By providing this service, VoodooSMS is working as our data processor. You can find out more about how VoodooSMS carries out that role.

If you volunteer with or are an employee of Citizens Advice East End

For everybody in the charity

Microsoft provides hosted email and collaboration tools through Office 365. You can access the data processing agreement we have with Microsoft here. The following personal data is recorded in Microsoft Entra which provides identity information to Office 365: your full name, your login name, your work email address, your encrypted password, your work address, your job-role, your relationship with your manager and those who you manage (if applicable). You may optionally provide your mobile phone number and/or a secondary email address for password recovery or multifactor authentication. This information is used to provide email and collaboration services that are relevant to your work.

We also subscribe to Google’s Workspace collaboration product to facilitate the management of Citizens Advice East End mobile devices, and access to information resources provided by National Citizens Advice. You can view the data processing agreement we have with Google here. The following personal data is recorded in Google Workspace: your full name, your login name, and your email address. If you have access to a Citizens Advice East End owned Chromebook or Android phone, the details of the device you use are also stored in Google’s Workspace product in a way that relates your login to the device’s unique identifier. In addition to the core Google Workspace products, we use Google Analytics and Google My Business to understand how our website is used, and you use the same login information for these services as for the core Workspace product.

If you use a personal device such as a laptop, tablet, or mobile phone, we keep a record of that device that includes a unique identifier, make, model, and operating system type and version linked to your login name in the device management system, Microsoft Intune.

Our SMS service is hosted by VoodooSMS. You can view the VoodooSMS privacy policy here. If you have requested and been given a personal login to use the SMS service, VoodooSMS will have a record of your full name, work email address, and, optionally, your work phone number and mobile phone number. When creating your login, the IT team enters a randomly generated phone and mobile number, and you do not have to provide any information other than your name and work email. If you want to access our Wi-Fi service in one of our offices, you can provide your mobile phone number to verify your access. Wi-Fi access codes are sent through VoodooSMS’s service, where your mobile number, but no other personal details, are logged.

Our helpdesk service is provided by ManageEngine, a Zoho company. You can view the ManageEngine privacy policy here. The following personal data is recorded in the helpdesk: your full name, your email address, your work telephone number (where applicable) and the site(s) you work at. This information is recorded to help the IT team get in touch with you when you request IT support.

Our website is an instance of WordPress hosted by GoDaddy. You can view the GoDaddy privacy policy here. If you have been granted access to edit or update the Citizens Advice East End website, a record of your full name and email address is stored within the WordPress instance.

The IT team also uses a knowledge management product called Confluence, which is hosted in the EU by Atlassian. You can view the Atlassian Privacy Policy here. We store documentation about the IT equipment and IT services that we offer. Atlassian store the email address and full name of authorised users of this site. The IT documentation we maintain has a record of your name and email address under the following circumstances: (a) you have borrowed an item of Citizens Advice East End equipment such as a laptop, tablet, or secure USB; and/or (b) you are responsible for managing volunteers, and have information about volunteer Office 365 login accounts passed to you.

Records relating to your employment or volunteering with us are held online in our Office 365 SharePoint sites. Only authorised staff are permitted to access these records in their day-to-day job roles.

Your name and Citizens Advice East End email address is recorded in the minutes of meetings, which are held online in our Office 365 SharePoint sites. Minutes of team meetings and committee meetings are generally available to all members of the organisation, and may be shared with third parties such as our auditors or National Citizens Advice.

For paid employees

Moorepay Ltd are our payroll bureau who are under contract to us, and run the monthly payroll and submit the BACs instruction to pay you your net pay. You can view Moorepay’s privacy policy here. From May 2018’s payroll they will also arrange the payment of the PAYE and NI to HMRC. They hold your name, date of birth, address, NI number, gender, salary rate, number of hours worked, pension contribution rates and your starting and leaving dates in order to be able to calculate your pay and so that they can report your salary figures and deductions to HMRC on the charity’s behalf as required by law. You can view HMRC’s privacy charter here.

The charity has an auto enrolment pension scheme with TPT Retirement Solutions who hold your name, date of birth, address, NI number, gender, salary rate, number of hours worked and pension contribution amounts as well as your starting and leaving dates to be able to process your pension payments. You can view the TPT Retirement Solutions privacy policy here.

The charity has a pension scheme with Aviva for certain employees. Aviva hold your name, date of birth, address, NI number, gender, salary rate, number of hours worked and pension contribution amounts as well as your starting and leaving dates to be able to process your pension payments. You can view the Aviva privacy policy here.

Certain employees are members of the NACAB Pension Scheme, which holds the information given below. Citizens Advice act as our representative for this Pension Scheme. So, both national Citizens Advice and the NACAB Pension Scheme have this information regarding the members of the scheme. National Citizens Advice have a data sharing agreement directly with the pension provider.

The following personal information is held by the NACAB Pension Scheme and National Citizens Advice:

Personal data, including name, gender, national insurance number, date of birth, home address and telephone number, personal e-mail address, current or former employer, the date the member joined and left employment and his/her employment status (for example, full time or part time), dates on which the member joined and left pensionable service, salary information, normal or anticipated retirement date, status as a member of the Plan, information relating to contributions to and benefits under the Plan (including any contracted-out benefits), information relating to any money purchase benefits in the Plan (including how these are invested), information relating to any pension sharing or earmarking order, tax information including members’ income tax band and any protections in relation to a member’s pension benefits, bank account details.

Special categories of personal data including marital status and family and/or dependants (for example, in relation to death benefits); information relating to health (for example, if a member cannot work any longer due to incapacity and wants to take his/her pension benefits early).

Some staff may be members of a trade union. The trade union holds your name, address, gender, date of birth, NI number, payment frequency, payroll number and subscription amount to be able to check that you have paid the correct subscription amount compared with the level of benefits you have requested. You can view the Unite the Union’s privacy policy here.

Citizens Advice East End’s auditors are RPG Crouch Chapman LLP. When conducting the annual audit of our accounts, our auditors may view the following information: staff contracts and payroll reports which include staff name, date of birth, NI number, and address. Auditors may also see pension reports which include staff name, date of birth, NI number, address and the percentage we and staff pay into the staff-member’s pension scheme.

For trustees

Information about trustees, including names and contact information, is shared with Companies House, the Charity Commission, and the Financial Conduct Authority for regulatory purposes.

With your explicit consent, may share information with the funders below. We will tell you what information we are sharing, and ask for your explicit consent before sharing information. If you don’t want your information shared in this way, tell the adviser you speak to.

Albion Health Centre
Ann Tayler Children’s Centre
City and Hackney Centre for Mental Health
Daubeney Children’s Centre
Fuel Bank Foundation
Good Things Foundation
Homerton Hospital
Legal Advice Centre
Linden Children’s Centre
London Borough of Hackney
London Borough of Newham
London Borough of Tower Hamlets
Manor Park Surgery
Mapledene Children’s Centre
Sebright Children’s Centre
Trussell Trust
Oldhill (formerly Tyssen) Children’s Centre
Vicarage Lane Health Centre
Woodberry Down Children’s Centre

To help you, we may refer you to one of the service providers listed below. We will tell you what information we are sharing, and ask for your explicit consent before sharing information. If you don’t want your information shared in this way, tell the adviser you speak to.

AgeUK East London
City & Hackney Mind
deafPLUS
DV Solicitors
Edwards Duthie Shamash Solicitors
Fair Finance
Family Action
Hackney Community Law Centre
Hackney Marsh Partnership
Mile End Hospital
Ocean Somali Community Centre
Owen Stevens Solicitors
Praxis
Relate
Shelter

With your explicit consent, we may refer you to one of our partners in the London Borough of Tower Hamlets through the Local Community Fund (LCF). Referrals may take place through the THCAN Referral Portal. You can review the privacy notice online. Our LCF partners are:

Account3 Ltd
AgeUK East London
Bromley by Bow Centre
deafPLUS
Island Advice Centre
Legal Advice Centre
Limehouse Project
Ocean Somali Community Centre (OSCA)
Praxis Community Projects
St Peter’s Bengali Association
Tower Hamlets Law Centre
Toynbee Hall

We work in partnership with the housing associations below to help you with debt and housing-related issues. We will tell you what information we are sharing, and ask for your explicit consent before sharing information. If you don’t want your information shared in this way, tell the adviser you speak to.

Notting Hill Genesis
Southern Housing Group
London & Quadrant (L&Q)

Using our website

Our web-hosting company, GoDaddy, and Google Analytics, a service which helps us understand how our website is used, both have the facility to monitor and record connections to and from the Citizens Advice East End website. The monitoring data that our web-hosting company collects includes browser type, domain name visited, traffic volumes, time and date of access and IP address information. Google Analytics collects information about your engagement with our website, including your browser type, whether you are using a mobile or desktop device, when you accessed our site, and what pages you visited, and IP address information.

When you use our website, we collect your information in the following ways:

We use data called ‘cookies’ to get information about how you’re using our website – for example, what pages you click on and what device you’re using. You can find out how we collect and use cookies when you browse our website.
If you complete a form on our website, for example, if you apply to volunteer with us, the data is stored in Microsoft’s Office 365 product. By providing this service, Microsoft is working as our data processor. You can find out more about how Microsoft carries out that role.

Applying to volunteer with us

When you enter information on our website, we ask for your contact details including name, email and phone number. This is so we can respond to you. We also ask you to provide information in support of your application to volunteer with us.

We get your permission to collect your information by asking you to tick a box to give your consent.

We don’t share your personal information and use it only for our internal recruitment process. We retain volunteer applications for six months.

Contact us about your information

If you have any questions about how your information is collected or used, you can contact our offices.

Contact our administration line on: 020 3855 4590‬, Monday to Friday 09:30 to 17:00.

You can also email: privacy@eastendcab.org.uk.

You can contact us to:

Find out what personal information we hold about you;
Correct your information if it’s wrong, out of date or incomplete;
Request we delete your information;
Ask us to limit what we do with your data – for example, ask us not to share it if you haven’t asked us already;
Ask us to give you a copy of the data we hold in a format you can use to transfer it to another service;
Ask us stop using your information.

Who’s responsible for looking after your personal information

The national Citizens Advice charity and your local Citizens Advice, Citizens Advice East End, operate a system called Casebook to keep your personal information safe. This means they’re a ‘joint data controller’ for your personal information that’s stored in our Casebook system.

Each local Citizens Advice, including East End Citizens Advice, is an independent charity, and a member of the national Citizens Advice charity. The Citizens Advice membership agreement also requires that the use of your information complies with data protection law.

You can find out more about your data rights on the Information Commissioner’s website.

Changes to this policy

25 October 2023: Removed completed projects. Added information about meeting minutes and business registrations. Added information about device management.

18 August 2023: Revised text to clarify usage of VoodooSMS system. Minor corrections. Updated links to Citizens Advice privacy policy.

8 February 2022: Revised text of policy. Updated information about partners. Added link to Moorepay’s privacy policy. Updated contact details. Modernised page layout.

4 July 2021: Revised information about partners we share information with. Updated link to Microsoft’s product terms.

27 April 2020: Revised contact details in response to Covid-19 remote working. Revised list of partners we share information with. Minor corrections to spelling and grammar.

25 May 2018: Made clear that clients can tell adviser that they do not want information shared with partners. Corrected contact details.

24 May 2018: Added extra details about data sharing that affects our employees and listed funders, partner service providers, and housing associations separately under “How Citizens Advice East End shares your information”.

23 May 2018: First publication on-line.