In order to carry out our work, it may be necessary for us to collect, store and process your personal information. Community Advice and Law Service takes its responsibilities very seriously with regard to safeguarding your personal data.
This privacy notice explains the types of personal data we may collect, how we will store and handle that data, and the steps that we will take to keep it safe, in accordance with the UK General Data Protection Regulation (UKGDPR). It applies to all clients, prospective clients and other contacts about whom we hold personal information.
We hope that this notice will answer any questions that you have about how we handle your personal data, but please feel free to get in touch with us at enquiries@advice-cals.org.uk if you require any further information.
Community Advice and Law Service is registered with the Information Commissioner’s Office. (Registration number: Z9942327)
What types of personal data might we collect?
Personal contact details such as names, addresses, telephone numbers and email addresses
Demographic information that helps us to monitor equal access to our services/equal opportunities in our recruitment processes, e.g. your age, your ethnicity, your gender etc.
Information relating to your education and past employment, if you are applying for a job with us.
Information relating to your advice needs; depending on your case, this might include information about your financial situation, your health, your housing situation, your immigration status etc.
Records of our communications with you, and of other communications and/or actions taken in relation to your case.
Data that is collected for the purposes of legal compliance, e.g. to carry out necessary money laundering checks etc.
How will we collect your data?
We normally collect your data when you provide it to us or when it is provided to us by others. You may give us your data by email; through an online form or web portal; over the telephone; face to face; or by post.
How will we use your data?
We will only collect, process and store your personal data in the following circumstances:
a) In order to provide you with legal advice, assistance and/or representation under the agreement/contract that we have with you;
b) In order to comply with our contractual obligations with external agencies such as the Legal Aid Agency which may be funding your case;
c) Where we reasonably require your data to pursue our legitimate interests as part of running of the Community Advice and Law Service, as long as this does not materially impact on your rights, freedom or interests; e.g. to process job applications or to satisfy the requirements of our external quality auditors.
d) Where we need to process your data to comply with the law and/or to protect someone’s life;
e) For certain categories of data, where we have your explicit consent, which may be withdrawn at any time.
We may also use your anonymised data to provide statistical information for reports to our funders and/or other external agencies and/or to ensure legal and regulatory compliance. We will ensure that individuals are not personally identifiable from this information.
Who do we share your personal data with?
We may sometimes need to share your personal data with trusted third parties. We will only do this where it is necessary for providing you advice and legal services and/or for the effective operation of these services.
For example, we may need to share your data with barristers; translators; costs draftsmen in order to progress your case. We may also need to share your data with secure file storage and destruction companies; our external quality auditors; our financial auditors; our external IT services provider; other Platform as a Service (PaaS) and Software as a Service (SaaS) cloud service providers (where they have been approved as organizational suppliers), and payment services providers.
In such cases, we will provide only the information that those third parties need to perform their specific services; they will only be permitted to use your data for the exact purposes we specify in our contract with them; we will work closely with them to ensure that your privacy is respected and protected at all times; and if we stop using their services, they will either delete or anonymise your data.
If you make a claim against our service, or if we consider circumstances have arisen which may give rise to a claim, then it may be necessary for us to supply a copy of your file to our insurers. In the case of a complaint, we may also need to share your case records with external authorities that regulate the legal profession so that they may investigate appropriately.
We may also need to share your data with the appropriate authorities if we become aware of significant safeguarding concerns where there is risk to your life or that of another person, and/or if we become aware of suspected criminal activities.
What are your responsibilities?
It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes while you are using our services.
If you send us personal data about anyone other than yourself you should ensure that, where appropriate, you have any appropriate consents and notices in place to enable you to transfer that personal data to us, and so that we may use it for the purposes for which you provide it to us.
What rights do you have?
You have the right to request access to any personal data that we hold about you.
You have the right to ask us to correct or update any information that we hold about you.
You have the right to ask us to stop processing your information, or to restrict the way in which your information is processed.
Where you have given us your consent to use your personal data, you have the right to change your mind at any time and withdraw that consent.
You have the right to request the erasure of your personal information where there is no good reason for us continuing to process or store it.
In certain circumstances, you can also ask us to transfer your personal information to a third party.
If you want to review, verify, correct or request erasure of your personal information, object to the processing of your personal data, or request that we transfer a copy of your personal information to another party, please contact enquiries@advice-cals.org.uk.
You will not usually have to pay a fee to access your personal information. However, in exceptional cases, if your request for access is deemed to be unreasonable and/or excessive, we have the right to decline your request or to charge a reasonable fee to cover the costs of collating and providing this information.
In cases where we are processing your personal data on the basis of our legitimate interest, you can ask us to stop for reasons connected to your individual situation. We must then do so unless we believe we have a legitimate overriding reason to continue processing your personal data. If we choose not to action your request, we will explain to you the reasons for our refusal.
How will we protect your data?
We take our responsibilities with regard to protecting your data very seriously.
We will treat your data with the utmost care and take all appropriate steps to protect it. We have clear data protection and information security policies and procedures in place, and these processes are regularly reviewed as part of our quality assurance and compliance processes.
We take all reasonable measures to protect our IT systems from Cyber Attack.
We regularly monitor our systems for possible vulnerabilities and attacks in order to identify ways of further strengthening security.
How long will we keep your data?
We will only keep your data for as long as is necessary for the purpose(s) for which it was provided. Normally, this will be for 6 years after your case or matter ends.
This protects you and us, should you be unhappy with our services and want to complain after your case ends.
In some exceptional cases we may determine that it is appropriate and/or necessary to keep data for longer than 6 years. We will notify you if we believe that your case falls into this category.
Where will your data be processed?
Your data will be stored and processed within UK or within the European Economic Area (EEA). If we ever need to share your personal data with third parties or suppliers outside EEA, we will seek your specific consent to do so.
How to make a complaint
If you have any concerns or questions about the way in which we are handling your data, please contact us at enquiries@advice-cals.org.uk so that we can discuss these with you.
If you believe that your data has not been handled appropriately, or if you are unhappy with our response to any requests that you have made with regard to your data, you have the right to make a complaint to the Information Commissioner’s Office. Further details about how to do this can be found on the Information Commissioner’s Office website at www.ico.gov.uk, or you can call them on 0303 123 1113.