Personal data is any information that identifies or relates to a specific person. This may include:

• Personal details such as name, contact information, and date of birth
• Details about your enquiry
• Information about your circumstances such as financial circumstances, benefits you receive, employment and housing status
• Demographics data that you provide us with
• If you have agreed to be contacted for feedback or communications
• Personal data of people in your household, for example, if you have children or are a carer
• If someone is seeking advice on your behalf, we may collect their details too
• Details of your donation, if you donate to us

We may also collect special category data or other sensitive information when necessary:

• Information that may inform the advice we provide, such as health conditions
• Demographics data that you provide us with
• Criminal activity data that may inform the advice and support we provide

If you do not want us to keep a record of the advice we provide, we can help you as best we can, but advice will be limited and general rather than specific to your circumstances.

We may collect your information:

• When you contact us including in person, by phone, videocall, webchat, email, letter or through our website
• From systems we use to support our work, such as appointment booking systems
• When you, or a third party, provides us with documentation
• From an organisation that referred you
• From someone acting on your behalf
• When you complete a survey or provide us feedback
• On CCTV when you attend our premises 
• Via cookies on our website
• When you make a donation to us, including through fundraising sites, such as JustGiving

We use social media to raise awareness of our services and promote our impact, and we are occasionally contacted this way with queries. To protect your personal information, we encourage you to contact us via other methods and we will seek agreement from you to transfer your personal information from social media to our systems.

We may use your information to:

• Contact you to support with your enquiry and explain how we can help
• Keep a record of our conversations and actions to inform your advice and support needs
• Support you in accessing our services, such as through British Sign Language or interpretation services
• Keep records for audit, standards, and insurance purposes
• Share information with other organisations, such as for referrals
• Report statistics or anonymised case studies to funders
• Develop and improve our services
• Manage donations
• Send communications
• Ask for your feedback on our services

We may also use your data to monitor the issues that are impacting the people we help. This informs our work advocating for changes to legislation and social policy. We do this through data analysis; however, we may use your experiences to inform our case studies. These will be anonymised.

Occasionally we may ask to share your story to bring awareness to an issue, we will only do this when you have given consent.

We only process your personal data when there is a lawful basis for us doing so. We may rely upon:

• Legitimate interests, such as for maintaining records of advice and support, to defend legal claims, and to maintain a high-quality service
• Public task, when we are delivering a statutory service
• Legal obligation, when we need to process your data to meet a legal obligation
• Your consent, such as when we contact you for feedback or refer you to another support organisation

Where we process special category data (such as health information), we may rely upon:

• Substantial public interest conditions
• Defence of legal claims
• Archiving, research and statistics
• Your explicit consent

When relying on substantial public interest conditions in Schedule 1 Part 2 of the DPA 2018 we are required to have an Appropriate Policy Document in place.

We only share your personal data when necessary and in line with data protection laws.

• If we need to share your information with CAS or other Bureaux
• With professional advisors such as insurers and legal professionals
• With auditors to maintain standards, such as for CAS Membership Standards audits, or with the Scottish Legal Aid Board (SLAB) for Scottish National Standards accreditation
• With funders as part of audit and compliance, or for research and reporting purposes. We anonymise this where possible
• To meet any legal and regulatory obligations
• If we use external service providers, we put in place contracts to ensure they follow data protection rules

We may share information with the following, only when you have consented:

• If we refer you to another organisation for support
• If someone is acting on your behalf, we may share your information with them when necessary
• If we engage with an organisation on your behalf, we may have to share information with them
• With funding partners to obtain feedback on our service provision
• With HMRC if you make a Gift Aid declaration as part of your donation

In exceptional circumstances, where there is a high risk of harm to an individual, information may be shared with third parties. We have strict Safeguarding procedures in place for when this may occur.

We only store personal data in the UK or the EU.

However, some of our suppliers may be based in other countries. If we need to share your data with these companies, we take steps to make sure your data is protected.

We will only keep your data for as long as is necessary. For most people we keep your data for a maximum of seven years. This is from the point of last contact.

We keep recordings of phone calls for two years.
In certain circumstances we are required to keep records for longer, for example, if you have arranged a debt remedy solution, your records are kept for the duration this is active.

In rare cases, we might keep your data for longer if there is a legal reason, such as an on-going complaint or legal case.

National Projects are projects delivered by Bureaux across the Citizens Advice Network and managed by CAS. Where you seek support from one of these projects, you may receive advice from an adviser
based in a Bureaux somewhere else in Scotland.

Some projects have a Privacy Notice which supplements this one, these are linked below:

• Patient Advice and Support Service Scotland (PASS)
• Pension Wise