Staff and volunteer privacy notice for Citizens Advice East End

Policy last reviewed 29 August 2024

If you are a client of Citizens Advice East End, please see our main privacy policy.

Your rights

At Citizens Advice we collect and use your personal information relating to our paid staff and volunteers to help manage our service. As a paid employee or volunteer, you have a number of rights regarding your personal information. You can:

access and obtain a copy of your data that identifies and relates to you, provided that there is no legal exemption for us to withhold disclosure
require Citizens Advice East End to change incorrect or incomplete data. Professional opinions may remain on file if relevant
Citizens Advice East End to delete or stop processing your data, for example where the data is no longer necessary for the purposes of processing
object to the processing of your data where Citizens Advice East End is relying on its legitimate interests as the legal ground for processing
ask Citizens Advice East End to stop processing data for a period if data is inaccurate or there is a dispute about whether or not your interests override Citizens Advice East End’s legitimate grounds for processing data

We only ask for the information we need. We always let you decide what you’re comfortable telling us, explain why we need it and treat it as confidential.

If you would like to exercise any of these rights, please email the privacy team at privacy@eastendcab.org.uk.

l If you believe that Citizens Advice East End has not complied with your data protection rights and you have raised it internally without success, you can complain to the data Commissioner through the ICO website.

You can check our main privacy policy for how we handle our clients’ and service users’ personal information.

How we will use your data when you’re an employee

Citizens Advice East End collects and processes personal data relating to its employees to manage the employment relationship. Citizens Advice East End is committed to being transparent about how it collects and uses that data and to meeting its data protection obligations.

Citizens Advice East End is the data controller for your personal data. Some personal data is shared with National Citizens Advice including for the following purposes:

Allow you to use national systems
Provide support and handle enquiries
Facilitate quality checks
Assist in handling complaints and grievances
Collecting expressions of interest for recruiting volunteers
Allow National to carry out finance functions on our behalf

National Citizens Advice privacy information in regards to local office staff and volunteers will be published on the national website soon.

Personal data Citizens Advice East End collects

Citizens Advice East End collects and processes a range of data about you. This includes:

your name, address and contact details, including email address and telephone number, date of birth, sex
the terms and conditions of your employment
details of your qualifications, skills, experience and employment history, including start and end dates with previous employers and your performance during the recruitment process
data about your remuneration, including entitlement to benefits such as pensions
details of your bank account and national insurance number
data about your emergency contacts
data about your nationality and entitlement to work in the UK
data about your criminal record (for certain roles)
details of your schedule (days of work and working hours) and attendance at work
details of periods of leave taken by you, including holiday, sickness absence, family leave and sabbaticals, and the reasons for the leave
details of any disciplinary or grievance procedures in which you have been involved, including any warnings issued to you and related correspondence
details of training you have participated in, performance improvement plans and related correspondence
data about medical or health conditions, including whether or not you have a disability for which Citizens Advice East End needs to make reasonable adjustments
details of trade union membership
equal opportunities monitoring data, including data about your ethnic origin, sexual orientation, gender identity, health and religion or belief

Citizens Advice East End collects this data in a variety of ways. For example, data is collected through:

Information collected directly from you, such as:

application forms
CVs
your passport or other identity documents such as your driving licence or right to work documents
forms completed by you at the start of, or during, employment correspondence with you
interviews, meetings or other assessments
Call recordings made for quality purposes
Routine record-keeping, such as in an accident book

Information we have collected about you such as:

References from previous employers
information from HMRC

Data is stored in a range of different places, including in your employee record file in Citizens Advice East End’s HR folder in Office 365 SharePoint, and in other IT systems such as Casebook and Google Workspace and Microsoft 365. Please see the section “How we use and store your information” for details about which systems we use for what purposes. Hard copy information such as historical HR and payroll information that has not been digitised is stored in a locked filing cabinet within a locked office at our Mare Street location.

How we use and store your information

This page covers how we store and handle paid staff and volunteer information locally in our offices.

For everybody in the charity

Microsoft provides hosted email and collaboration tools through Office 365. You can access the data processing agreement we have with Microsoft here. The following personal data is recorded in Microsoft Entra which provides identity information to Office 365: your full name, your login name, your work email address, your encrypted password, your work address, your job-role, your relationship with your manager and those who you manage (if applicable). You may optionally provide your mobile phone number and/or a secondary email address for password recovery or multifactor authentication. This information is used to provide email and collaboration services that are relevant to your work.

We also subscribe to Google’s Workspace collaboration product to facilitate the management of Citizens Advice East End mobile devices, and access to information resources provided by National Citizens Advice. You can view the data processing agreement we have with Google here. The following personal data is recorded in Google Workspace: your full name, your login name, and your email address. If you have access to a Citizens Advice East End owned Chromebook or Android phone, the details of the device you use are also stored in Google’s Workspace product in a way that relates your login to the device’s unique identifier. In addition to the core Google Workspace products, we use Google Analytics and Google My Business to understand how our website is used, and you use the same login information for these services as for the core Workspace product.

If you use a personal device such as a laptop, tablet, or mobile phone, we keep a record of that device that includes a unique identifier, make, model, and operating system type and version linked to your login name in the device management system, Microsoft Intune.

Our SMS service is hosted by VoodooSMS. You can view the VoodooSMS privacy policy here. If you have requested and been given a personal login to use the SMS service, VoodooSMS will have a record of your full name, work email address, and, optionally, your work phone number and mobile phone number. When creating your login, the IT team enters a randomly generated phone and mobile number, and you do not have to provide any information other than your name and work email.

Our helpdesk service is provided by ManageEngine, a Zoho company. You can view the ManageEngine privacy policy here. The following personal data is recorded in the helpdesk: your full name, your email address, your work telephone number (where applicable) and the site(s) you work at. This information is recorded to help the IT team get in touch with you when you request IT support.

Our website is an instance of WordPress hosted by GoDaddy. You can view the GoDaddy privacy policy here. If you have been granted access to edit or update the Citizens Advice East End website, a record of your full name and email address is stored within the WordPress instance.

The IT team also uses a knowledge management product called Confluence, which is hosted by Atlassian. You can view the Atlassian Privacy Policy here. We store documentation about the IT equipment and IT services that we offer. Atlassian store the email address and full name of authorised users of this site. The IT documentation we maintain has a record of your name and email address under the following circumstances: (a) you have borrowed an item of Citizens Advice East End equipment such as a laptop, tablet, or phone; or (b) you are responsible for managing volunteers, and have information about volunteer Office 365 login accounts passed to you; or (c) you are responsible for managing information about our IT services.

Records relating to your employment or volunteering with us are held online in our Office 365 SharePoint sites. Only authorised staff are permitted to access these records in their day-to-day job roles.

Your name and Citizens Advice East End email address is recorded in the minutes of meetings, which are held online in our Office 365 SharePoint sites. Minutes of team meetings and committee meetings are generally available to all members of the organisation, and may be shared with third parties such as our auditors or National Citizens Advice.

For paid employees

Pay and pensions

Moorepay Ltd are our payroll bureau who are under contract to us, and run the monthly payroll and submit the BACs instruction to pay you your net pay. You can view Moorepay’s privacy policy here. From May 2018’s payroll they will also arrange the payment of the PAYE and NI to HMRC. They hold your name, date of birth, address, NI number, gender, salary rate, number of hours worked, pension contribution rates and your starting and leaving dates in order to be able to calculate your pay and so that they can report your salary figures and deductions to HMRC on the charity’s behalf as required by law. You can view HMRC’s privacy charter here.

The charity has an auto enrolment pension scheme with TPT Retirement Solutions who hold your name, date of birth, address, NI number, gender, salary rate, number of hours worked and pension contribution amounts as well as your starting and leaving dates to be able to process your pension payments. You can view the TPT Retirement Solutions privacy policy here.

The charity has a pension scheme with Aviva for certain employees. Aviva hold your name, date of birth, address, NI number, gender, salary rate, number of hours worked and pension contribution amounts as well as your starting and leaving dates to be able to process your pension payments. You can view the Aviva privacy policy here.

Certain employees are members of the NACAB Pension Scheme, which holds the information given below. Citizens Advice act as our representative for this Pension Scheme. So, both national Citizens Advice and the NACAB Pension Scheme have this information regarding the members of the scheme. National Citizens Advice have a data sharing agreement directly with the pension provider.

The following personal information is held by the NACAB Pension Scheme and National Citizens Advice:

Personal data, including name, gender, national insurance number, date of birth, home address and telephone number, personal e-mail address, current or former employer, the date the member joined and left employment and his/her employment status (for example, full time or part time), dates on which the member joined and left pensionable service, salary information, normal or anticipated retirement date, status as a member of the Plan, information relating to contributions to and benefits under the Plan (including any contracted-out benefits), information relating to any money purchase benefits in the Plan (including how these are invested), information relating to any pension sharing or earmarking order, tax information including members’ income tax band and any protections in relation to a member’s pension benefits, bank account details.

Special categories of personal data including marital status and family and/or dependants (for example, in relation to death benefits); information relating to health (for example, if a member cannot work any longer due to incapacity and wants to take his/her pension benefits early).

Other

Some staff may be members of a trade union. The trade union holds your name, address, gender, date of birth, NI number, payment frequency, payroll number and subscription amount to be able to check that you have paid the correct subscription amount compared with the level of benefits you have requested. You can view the Unite the Union’s privacy policy here.

Citizens Advice East End’s auditors are RPG Crouch Chapman LLP. When conducting the annual audit of our accounts, our auditors may view the following information: staff contracts and payroll reports which include staff name, date of birth, NI number, and address. Auditors may also see pension reports which include staff name, date of birth, NI number, address and the percentage we and staff pay into the staff-member’s pension scheme.

We use uCheck to process DBS checks. You can view their data processing arrangement with us, and their applicant privacy policy.

For trustees

Information about trustees, including names and contact information, is shared with Companies House, the Charity Commission, and the Financial Conduct Authority for regulatory purposes.

Why Citizens Advice East End processes personal data

Citizens Advice East End needs to process data to enter into an employment contract with you and to meet its obligations under your employment contract. For example, it needs to process your data to provide you with an employment contract, to pay you in accordance with your employment contract and to administer benefits, pension and insurance entitlements.

In some cases, Citizens Advice East End needs to process data to ensure that it is complying with its legal obligations. For example, it is required to check an employee’s entitlement to work in the UK, to deduct tax, to comply with health and safety laws and to enable employees to take periods of leave to which they are entitled. For certain positions, it is necessary to carry out criminal records checks to ensure that individuals are permitted to undertake the role in question.

In other cases, Citizens Advice East End has a legitimate interest in processing personal data before, during and after the end of the employment relationship such as call recordings

Processing employee data allows Citizens Advice East End to:

run recruitment and job change processes
maintain accurate and up-to-date employment records and contact details (including details of who to contact in the event of an emergency), and records of employee contractual and statutory rights
operate and keep a record of disciplinary and grievance processes, to ensure acceptable conduct within the workplace and outside of the workplace, such as social media
operate and keep a record of employee performance and related processes for workforce planning purposes, personal development and relevant support
operate and keep a record of absence and absence management procedures, to allow effective workforce management and ensure that employees are receiving the pay or other benefits to which they are entitled
obtain occupational health advice, to ensure that it complies with duties in relation to individuals with disabilities, meet its obligations under health and safety law, and ensure that employees are receiving the pay or other benefits to which they are entitled
operate and keep a record of other types of leave including but not limited to maternity, paternity, adoption, parental and shared parental leave, to allow effective workforce management, to ensure that Citizens Advice East End complies with duties in relation to leave entitlement, and to ensure that employees are receiving the pay or other benefits to which they are entitled
ensure effective general HR and business administration
provide references on request for current or former employees
respond to and defend against legal claims
maintain and promote equality in the workplace

Who has access to data

The senior management team and members of the trustee board have access to personal and relevant special category data, as required for their respective functions and roles
The management team has access to your contact details, emergency contacts, sickness records and performance data within SharePoint in Office 365
Administrators have access to some personal data, for example they will be able to view your appraisals, attendance records, and support and supervision records in supporting managers
The IT team has access to some personal data in order to create and manage your login and access to our systems
Citizens Advice nationally have access to some of your personal data such as contact information, job role and work patterns in order for you to use national systems such as Casebook, Skillbook and Okta.
Citizens Advice East End uses an external organisation, Moorepay, to process your personal data to for payroll purposes. Personal information may be shared with other organisations in relation to pension enrolment or trade union membership More information about the external organisations can be found in the “How we store your information” section
Citizens Advice performance assessors may have view access to your staff and volunteers records to ensure that our management processes are robust

Citizens Advice East End shares your data with third parties in order to obtain pre-employment references from other employers, and obtain necessary criminal records checks from the Disclosure and Barring Service (DBS) for certain roles. Citizens Advice East End may also share your data with third parties in the context of a transfer of undertakings (TUPE). In those circumstances the data will be subject to confidentiality arrangements.

If you have any questions about this, please use the contact details in the “Your rights” section.

Citizens Advice East End will not directly transfer your data to countries outside the European Economic Area (EEA). National Citizens Advice systems do not transfer your data outside of the EEA.

Some special categories of personal data, such as data about health or medical conditions, are processed to carry out employment law obligations (such as those in relation to employees with disabilities and for health and safety purposes). Data about trade union membership is processed to allow Citizens Advice East End to make deductions from salary for union fees.

Where Citizens Advice East End processes other special categories of personal data, such as data about ethnic origin, sexual orientation, health or religion or belief, this is done for the purposes of equal opportunities monitoring. Data that Citizens Advice East End uses for these purposes is always anonymised or pseudonymised.

How Citizens Advice East End protects data

Citizens Advice East End takes the security of your data seriously. Citizens Advice East End has internal policies and controls in place to try to ensure that your data is not lost, accidentally destroyed, misused or disclosed, and is not accessed except by its employees in the performance of their duties.

All users are required to comply with the IT Acceptable Use policy and the Acceptable Use policy for Casebook, social media and personal devices.

Where Citizens Advice East End engages third parties to process personal data on its behalf, they do so on the basis of written instructions, are under a duty of confidentiality and are obliged to implement appropriate technical and organisational measures to ensure the security of data.

How long Citizens Advice East End keeps data

Citizens Advice East End will hold your personal data for the duration of your employment. The periods for which your data is held after the end of employment are outlined in Citizens Advice East End’s data retention policy.

Changes to this policy

29 August 2024: Substantial rewrite to bring into line with best practice.

13 March 2023: First publication: separated service user and employee/volunteer policies.