CASES Privacy policy

We only ask for the information we need. We always let you decide what you’re comfortable telling us, explain why we need it, and treat it as confidential.

When we record and use your personal information, we:

• Only access it when we have a good reason
• Only share what is necessary and relevant
• Don’t sell it to anyone

We collect and use the details you give us so we can help you. We have a ‘legitimate interest’ to do this under data protection law. This means it lets us carry out our aims and goals as an organisation. We’ll always explain how we use your information.

At times, we might use or share your information without your permission. If we do, we’ll always make sure there’s a legal basis for it. This could include situations where we must use or share your information:

• To comply with the law – for example, if a court orders us to share information (‘legal obligation’)
• To protect someone’s life – for example, sharing information with a paramedic if a client is unwell at our office (‘vital interests’)
• To carry out our legitimate aims and goals as a charity – for example, to create statistics for national research (‘legitimate interests’)
• To carry out a task in the public interest – for example, delivering a government or local authority service (‘public task’)
• To fulfil a contract we have with you – for example, storing your bank details to pay you if you are an employee (‘contract’)
• To defend our legal rights – for example, sharing information with our legal advisors if there is a complaint

We handle and store your personal information in accordance with the data protection legislation – including the General Data Protection Regulation (GDPR) and the Data Protection Act 2018 (DPA).

You can check our main Citizens Advice policy to see how we handle most of your personal information.

What information does CASES ask for and how do we collect and use your data?

To find out what information we ask for and how we collect and use your data, see our national Citizens Advice privacy policy.

The data we collect at CASES when you seek our advice

We will need to obtain your personal information to deliver our services to you. This may include:

• Your name and date of birth
• Your address, email address and telephone number(s)
• Information to verify and confirm your details (e.g. birth certificate or passport details, proof of address)
• Your communication preferences
• Any additional information needed to deliver a service to you

We collect most of this information directly from you via face-to-face interviews, over the telephone, or by email. However, we may also collect information from:

• Publicly accessible sources
• Third parties with your consent

When you give us authority to act on your behalf, we will need to share your personal information with the relevant third-party organisation to assist you with your enquiry.

CASES is committed to protecting your personal data. We ensure GDPR compliance by implementing data processing agreements and contractual clauses with third parties. We regularly review and audit these arrangements to maintain the security and privacy of your information.

How CASES stores your information

All personal client data collected is stored within the national case recording system, Casebook. Certain information may also be stored on CASES Google Drive or Microsoft Office 365 – both secure, cloud-based systems.

Data security

We have appropriate security measures in place to prevent your information from being accidentally lost, used, accessed without authorisation, altered, or disclosed. Access to your information is limited to employees and third parties who have a business need to know. They are bound by confidentiality obligations.

We have procedures in place to manage any suspected data breach. If necessary, we will notify you and the appropriate regulatory bodies.

Data retention

We retain your data only for as long as necessary to fulfil the purposes for which it was collected, including satisfying legal, accounting, or reporting requirements.

To determine the appropriate retention period, we consider:

• The amount, nature, and sensitivity of the data
• The potential risk of harm from unauthorised use
• The purposes for processing
• Applicable legal requirements

How CASES uses your data when applying to work or volunteer

We will collect personal information including:

• Name, address, date of birth, telephone and email contact details
• Previous employers, job roles, and references
• Nationality, visa status, right to work documentation
• Results of any pre-employment checks (e.g. DBS)
• Notes from interviews
• Bank account details (for paid positions)
• Emergency contact details

We may also collect special category data, such as disability information, to enable reasonable adjustments during the recruitment process.

What CASES uses your information for

We process your personal data to:

• Manage and assess your application
• Comply with legal or regulatory requirements
• Verify your eligibility to work in the UK
• Support our legitimate interests in hiring suitable candidates

If successful, your personal data will be transferred to your Human Resources file. If unsuccessful, we will retain your application data for 12 months from receipt.

Who CASES shares your information with

Internally, your information may be shared with:

• Managers
• HR staff
• Admin support teams

Externally, we may share information with:

• Suppliers conducting DBS checks
• IT providers
• Payroll service providers
• Telephony service providers

Information sharing is limited to what is necessary and lawful.

How CASES stores recruitment information

Recruitment data is stored on CASES Google Drive or Microsoft Office 365 secure cloud systems.

Data security for recruitment information

We implement strong security measures to protect recruitment data and manage suspected breaches appropriately.

Data retention for recruitment

Successful applicants: personal data is stored for employment record-keeping. Unsuccessful applicants: data is retained for 12 months unless otherwise agreed.

How we use your data for research, feedback, and statistics

This section covers how we use your data to carry out research, collect feedback, and produce statistics. National Citizens Advice covers broader uses of data for these purposes in their privacy policy.

Your legal rights

You have the right to:

• Request access to your personal data (Subject Access Request)
• Request correction of inaccurate data
• Request erasure of your personal data
• Withdraw consent (where applicable)

If you wish to exercise your rights, contact us at: Email: office@casestaffs.org.uk

We aim to respond within one calendar month. There is no fee unless a request is repetitive, unfounded, or excessive.

Complaints

If you have a complaint regarding your personal data, contact us first at: Email: office@casestaffs.org.uk

If you are not satisfied with our response, you can contact the Information Commissioner’s Office (ICO): Website: www.ico.org.uk Helpline: 0303 123 1113 Address:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF