Data Protection and Privacy

Privacy Policy

At Citizens Advice Cardiff and Vale, we collect and use your personal information to help solve your problems, improve our services and tackle wider issues in society that affect people’s lives.

This privacy policy explains how we use your information and what your rights are. We handle and store your personal information in line with data protection law and our confidentiality policy. The following pages explain how we use your information in more detail.

Our network

Citizens Advice is a membership organisation made up of the national Citizens Advice charity and many local offices across England and Wales, including Citizens Advice Cardiff and Vale. Citizens Advice Cardiff and Vale are an independent charity and a member of the national Citizens Advice charity.

All members of the Citizens Advice network are responsible for keeping your personal information safe and making sure data protection law is followed. 

Members of the network also run some jointly designed services and use some of the same systems to process your personal data. In these instances, we are joint data controllers for these activities.

Jointly controlled data

All offices in the Citizens Advice network use some joint systems to carry out our activities. These include joint case management systems, telephony platforms and more. 

Staff from a different local Citizens Advice can only access your personal information in a joint system if they have a good reason. For example, when:

you go to a different office to seek advice

more than one office is working together in partnership

they need to investigate a complaint or incident

We have rules and controls in place to stop people accessing or using your information when they shouldn’t.

Tell an adviser if you’re worried about your details being on a national system. We’ll work with you to take extra steps to protect your information – for example by recording your problem without using your name.

National Citizens Advice has a privacy notice available on their website that covers general advice and nationally managed systems, including our case management systems. This policy covers the processing we carry out in our office.

How we use your data for advice

This section covers how we use your data to provide you with advice.

For general advice and nationally funded advice programmes, please see the national Citizens Advice privacy notice.

How we collect your information

When we provide advice, we either collect this data directly from you or receive it through a referral from a partner organisation.

We will collect this data in different ways depending on how you approach our service, including:

face to face – for example by discussing your situation with an advisor

completing a form – this could be a digital form or paper form

over the phone – for example by calling Advicelink or a local office directly

webchat/ WhatsApp

We also receive information from partner organisations through referral mechanisms. Where you are referred to us, you should be advised that you are being referred as well as what information we will be provided by our referral partners.

What information we collect

To support your enquiry we collect information about you and your circumstances. You can choose which information you give us, but not providing certain information may limit the advice we can give you. This may include:

your name – you can ask to remain unnamed, but this may limit the advice we are able to provide

contact details such as your address, phone number and email address

profile information such as your date of birth and whether you have any accessibility requirements

We will also collect any information about your issue which could help us provide you with advice which can include:

information about your finances – for example your income, expenditure, debts, benefits or pension

credit reports – we may get copies of your credit history with your permission

details of the products or services you are having issues with

details of your housing such as your rent, mortgage and housing conditions

information about your health or disability

details of any discrimination you face

If you contact us by phone we will also record the phone call for training and monitoring purposes.

You may also be asked to provide demographic information at your advice session. This will not affect the advice you receive and will be used to understand more about our service. For more information see the section on statistical processing.

Information about third party individuals

We may also gather information about you if you aren’t one of our clients. We will do this if it is relevant to provide a client with advice. For example, to assist a client with a debt assessment we will need relevant financial information about members of their household.

What we use your information for

We use the information you give us to:

provide you with advice, guidance and information

stay in touch with you about the advice we are providing

help with applications such as a debt recovery order or benefit claim

training our staff and volunteers

assess the quality of our advice

investigate complaints or claims

get feedback from you about our services

help us improve our services

address the root causes of the issue you are experiencing

share stories about your experience with Citizens Advice, with your permission

We may also record any unacceptable behaviour from clients if we deem this to cause disruption to our service or threaten the wellbeing of our staff, volunteers or any other person.

In some circumstances we may also use your information to carry out legal obligations, including for:

safeguarding

fraud prevention

regulatory compliance

Our confidentiality policy

At Citizens Advice we have a confidentiality policy which states that anything you tell us as part of advice will not be shared outside of the Citizens Advice network, unless you provide your permission for us to do so.

There are some exceptions to this such as needing to share:

to prevent an immediate risk of harm to an individual

in select circumstances if it is in the best interests of the client

where we are compelled to do so by law – for example a court order or meeting statutory disclosures

where there is an overriding public interest, such as to prevent harm against someone or to investigate a crime

to defend against a complaint or legal claim

to protect our name and reputation – for example to provide our side of a story reported in the press

There may be some services which may be exempt from this policy. For example, there are some services which we deliver jointly with partner organisations using joint systems. Where this is the case, you will always be advised of this when you are seeking advice.

Who we share your information with

In addition to the categories of recipients below, we may also ask to refer you to another organisation who we think will be able to provide you with more support. We will ask your permission to make any such referral.

Referral partners

We will share your information with partners when we want to refer you to another service. This may be as part of a jointly run service or where we believe another organisation may be better placed to provide you with the advice you need. We will only make a referral when you have given us your permission to do so. 

Some established referral partners include:

The Extra Help Unit – run by Citizens Advice Scotland who manage complaints with energy suppliers on behalf of people who may be considered vulnerable or at risk of disconnection

Trussell Trust – to issue you with a food bank voucher

Fuel bank foundation – to issue you with a fuel voucher

Cardiff Council and Vale of Glamorgan Councils (for example when helping you claim Council Tax Support)

Department of Work and Pensions (for example when helping you to appeal against refusal of a welfare benefit)

Howells Solicitors

Shelter Cymru

Speakeasy Law Centre (to provide specialist advice on debt, housing and welfare benefit issues)

SNAP Cymru

Race Council Cymru

Barnardo’s Cymru

Vale Domestic Abuse Services

The Nelson Trust

Care & Repair Cardiff and the Vale

Funders

We share information with our funders in order to demonstrate that we are meeting the funding requirements. Information will normally only be shared in a de-identified manner unless you give us your permission to do so or we need to in order to investigate a quality issue, complaint or claim.

Regulators

We are legally required to provide information to regulatory bodies in some circumstances. These include but are not limited to:

Ofgem – the regulator for gas and electricity

Ofcom – the regulator for the broadcasting, telecoms and postal industry

the Financial Conduct Authority – the regulator for financial and banking services

the Competition and Markets Authority

the Food Standards Agency

the Legal Services Board

Trading Standards

Auditors

We share information with our internal and external auditors to allow them to carry out audits to ensure that we are complying with our legal obligations and standards of best practice in how we run the organisation.

Banks, credit reference agencies and creditors

We may also share your information with banks or creditors to help get information to assist in our advice. We will only do this with your permission or where we are legally required to do so. Information we share will be used for purposes including:

getting a credit report to assist with financial enquiries

understanding more about your income and expenditure

understanding more about the debts you owe

Employers or benefit providers

We may also contact your employer or benefit provider to understand more about your income, we will only do this with your permission.

Translation and interpretation services

We may share your information with a translation or interpretation service to enable us to communicate with clients who prefer communication in different languages.

Our lawful basis for using your information


Activity	Lawful basis for collecting personal data	Lawful basis for collecting special category or criminal convictions data
General advice provision and funded services	Legitimate interests – we have a legitimate interest to provide advice to our clients	Establishment, exercise or defence of legal claims - where we are helping clients establish their legal rights Substantial Public Interest (provision of confidential counselling, advice or support) – where we are providing advice to clients which doesn’t relate to their legal rights.
Consumer service and energy advice	Public task – we have a statutory obligation to provide consumer and energy advice	Substantial public interest (statutory obligation) – we have a statutory obligation to provide consumer and energy advice
Accessibility requirements	Legal obligation – we have legal obligations in accordance with the equalities legislation	Substantial public interest (statutory obligation) – obligations under equalities legislation.
Marketing new advice services	Legitimate interests – we have a legitimate interest in promoting advice services which could benefit our clients Consent – where marketing rules require consent to do so	N/A
Maintaining quality and standards	Legitimate interests – we have a legitimate interest in ensuring that our service is run properly and that standards are maintained	Establishment, exercise or defence of legal claims Substantial public interest (protecting the public against dishonesty etc) – where we are carrying out functions to protect against: – dishonesty, malpractice or other seriously improper conduct – unfitness or incompetence – mismanagement in administration
Safeguarding	Public task – in complying with safeguarding obligations	Substantial public interest (Safeguarding of children and of individuals at risk)
Fraud prevention	Legitimate interests – we have a legitimate interest in defending against fraudulent activity Legal obligation – in some circumstances there are legal obligations to disclose actual or suspected cases of fraud	Substantial public interest – (preventing and detecting unlawful acts, preventing fraud, Suspicion of terrorist financing or money laundering)

How we use your data for research, feedback and statistics

This section covers how we use your data to carry out our research, feedback and statistical work. National Citizens Advice covers their use of data for this purpose in their privacy notice.

How we use your data for fundraising and donations

This section covers how we use your data to carry out our fundraising activities.

National Citizens Advice covers their use of data for fundraising in their privacy notice.

How we use your data when using our website

This section covers how we use your data when using our website, including how we use cookies. National Citizens Advice covers their use of cookies in their privacy notice.

How we use your information when you visit our website

When you visit cacv.org.uk, we collect certain information to help us understand how the site is used and to improve your experience. We are the data controller for this processing. Our legal basis is legitimate interests (UK GDPR, Article 6(1)(f)) — specifically, our interest in understanding website usage and improving our services.

Cookies

We use cookies on this website. When you first visit, you will see a cookie banner asking for your preferences. You can change your cookie settings at any time using the cookie settings link in the website footer.

We use cookies in four categories:

Functional cookies — required for core features of the website to work properly. You can manage these in your cookie settings.

Preference cookies — remember your settings, such as accessibility preferences you have chosen (for example, larger text or higher contrast).

Statistics cookies — help us understand how visitors use the website.

Independent Analytics Pro sets an analytics cookie (lasting up to 3 years) that tracks anonymous page visits. This tool is designed to be privacy-friendly and does not share data with advertising networks.

Google Analytics sets cookies (_ga, _gat, _gid) that collect information about how you use the site, including which pages you visit. This data is processed by Google and may be used in accordance with Google’s privacy policy.

Marketing cookies — used by the ShareThis social sharing widget. This sets a device identifier cookie (_stid) to recognise your device if you use the sharing features.

Accessibility tools

We use an accessibility widget provided by UserWay, which loads from cdn.userway.org. If you adjust accessibility settings (such as font size or contrast), your preferences are stored so the site remembers them on future visits.

Security and performance

Our website uses Cloudflare for security and performance. Cloudflare sets security and performance cookies to help protect the site and deliver content efficiently.

Third-party tools

Some features on the website connect to services run by other organisations, which have their own privacy policies:

WhatsApp chat — if you click the WhatsApp button to contact us, you will be taken to WhatsApp, which is operated by Meta. Meta’s privacy policy applies to your use of WhatsApp.

Google Translate — if you use the translation widget, Google’s privacy policy applies.

We do not collect contact form submissions on this website. If you click a link to get advice, you will be taken to citizensadvice.org.uk/wales, the national Citizens Advice website, which has its own privacy policy.

How long we keep your data for

National Citizens Advice is responsible for managing any data in joint client case records. For more information please see their privacy notice.

We will only keep your information for the minimum period necessary. The information outlined in this privacy notice will be kept after all action on your enquiry has finished, and the period required by data protection law has passed. All information will be held securely and destroyed confidentially when the retention date is reached.

We may keep paper copies relating to your enquiry if it is necessary. All paper records will be destroyed or returned when they’re uploaded to your case record or when we close your enquiry.

Third party processors

Third party processors are other organisations that carry out data processing on our behalf. Third party processors don’t use data for their own purposes and we have agreements in line with data protection law.

We use third-party providers;

for hosting our website and IT systems

to provide translation services

to provide telephony platforms

for referral systems

This enables us to provide multi-channel advice, to refer to organisations who may be better placed to assist you and to help remove barriers to understanding advice.

Your data protection rights

You have rights in relation to your personal data that we hold. Your rights include being able to request:

Access to copies of your data

Corrections are made to inaccurate data

Deletion of your personal data

Object to how we use your personal data

These rights are not absolute and may not apply in every circumstance. For more information about your rights you can visit the ICO website.

To make a data protection rights request you can do so by emailing; administrator@cacv.org.uk

Raising a concern about how we use your information

If you have any questions or concerns about how we’ve handled your personal information please contact us:

Telephone: 01446 722812, open Monday to Friday 9am to 5pm

Email: administrator@cacv.org.uk

You can also contact the national charity if you are unhappy with how we have used your personal data. To do so you can email; DPO@citizensadvice.org.uk

Contacting the Information Commissioner’s Office (ICO)

If you are unhappy with how we’ve used your personal information, you can also raise your concern with the Information Commissioner’s Office which regulates data protection law in the UK. They will normally expect you to have made a complaint to us directly in the first instance.