Privacy Policy

At Cyngor ar Bopeth Conwy Gwynedd Citizens Advice, we collect and use your personal information to help solve your problems, improve our services and tackle wider issues in society that affect people’s lives.

This privacy policy explains how we use your information and what your rights are. We handle and store your personal information in line with data protection law and our confidentiality policy. The following pages tell you more about how we use your information in more detail.

Our network

Citizens Advice is a membership organisation made up of the national Citizens Advice charity and many local offices across England and Wales, including Cyngor ar Bopeth Conwy Gwynedd Citizens Advice. Cyngor ar Bopeth Conwy Gwynedd Citizens Advice is an independent charity and a member of the national Citizens Advice charity.

All members of the Citizens Advice network are responsible for keeping your personal information safe and making sure data protection law is followed.

Members of the network also run some jointly designed services and use some of the same systems to process your personal data. In these instances we are joint data controllers for these activities.

Jointly controlled data

All offices in the Citizens Advice network use some joint systems to carry out our activities. These include joint case management systems, telephony platforms and more.

Staff from a different local Citizens Advice can only access your personal information in a joint system if they have a good reason. For example when:

you go to a different office to seek advice
more than one office is working together in partnership
they need to investigate a complaint or incident

We have rules and controls in place to stop people accessing or using your information when they shouldn’t.

Tell an adviser if you’re worried about your details being on a national system. We’ll work with you to take extra steps to protect your information – for example by recording your problem without using your name.

National Citizens Advice has a privacy notice available on their website that covers general advice and nationally managed systems, including our case management systems. This policy covers the processing we carry out in our office.

How we use your data for advice

This section covers how we use your data to provide you with advice.

For general advice and nationally funded advice programmes please see the national Citizens Advice privacy notice.

How we collect your information

We may ask you to:

sign a paper consent form
tick a box online
give agreement over the phone

Before we ask for your permission, we’ll always explain how we use your information.

In addition to the methods set out in our main policy, we may receive personal information by our referral partners when they refer you to us for debt, housing or welfare benefit advice. In these circumstances, our partners will ask you for your permission to make the referral and to give your personal information to us.

What information we collect

We’ll only ask for information that’s relevant. Depending on what you want help with, this might include:

your name and contact details – so we can keep in touch with you about your case
personal information – for example about family, work, or financial circumstances, or if you’re vulnerable or at risk of harm
details about services you get that are causing you problems – like energy or post
details of items or services you’ve bought and traders you’ve dealt with
information like your gender, ethnicity or sexual orientation.

To find out more about what information we collect, please see our national Citizens Advice privacy notice.

What we use your information for

The main reason we ask for your information is to provide you with information and advice to help solve your problem.

We also use your information:

for training and quality purposes
to investigate complaints
to help us improve our services
to defend legal claims
to help ensure our service is accessible to you

Our confidentiality policy

At Citizens Advice we have a confidentiality policy which states that anything you tell us as part of advice will not be shared outside of the Citizens Advice network unless you provide your permission for us to do so.

There are some exceptions to this such as needing to share:

to prevent an immediate risk of harm to an individual
in select circumstances if it is in the best interests of the client
where we are compelled to do so by law (e.g. a court order or meeting statutory disclosures)
where there is an overriding public interest such as to prevent harm against someone or to investigate a crime
to defend against a complaint or legal claim
to protect our name and reputation for example to provide our side of a story reported in the press

Who we share your information with

When you give us authority to act on your behalf, for example to help you with a Universal Credit claim, we may need to share information with that third party.

As a result of offering you our services, we may share information with third parties such as, but not limited to:

Cyngor Gwynedd Council (for example when helping you claim Council Tax Support)
Department of Work and Pensions (for example, when helping you to appeal against the refusal of a welfare benefit)
Adra Housing
Shelter Cymru

Our lawful basis for using your information

We use the following lawful bases to use your information to help you resolve your problem(s):

Legitimate interest – We have a legitimate interest to provide you with advice.

We also have a legitimate interest to:

ensure that we are meeting appropriate quality and standards in our advice to clients
defend legal claims
investigate complaints and implement lessons learned from them
ensure our service is accessible
promote equity and diversity in our service.

Establishment, exercise or defence of legal claims – Where we are helping you establish your legal rights, for example in relation to benefits.

Also, where we are investigating complaints and defending against legal claims,

Substantial Public Interest (provision of confidential counselling, advice or support) – Where we are providing advice to you which doesn’t relate to your legal rights, for example in relation to your wellbeing.

Also, where we are investigating complaints, defending against legal claims, are helping to ensure that our service is accessible and to promote equity and diversity in our service.

Vital interests – Where a person’s life may be in danger.

How we use your data for research, feedback and statistics

This section covers how we use your data to carry out our research, feedback and statistical work..

National Citizens Advice covers their use of data for this purpose in their privacy notice.

How we collect your information

We’ll get your permission by asking you to either:

sign a paper consent form
tick a box online
give agreement over the phone

Before we ask for your permission, we’ll always explain how we use your information.

What information we collect

We collect and analyse anonymised information to identify trends within our local areas and to report to our funders. We do not disclose any personal information for this purpose. If a dataset is so small that an individual could potentially be identified, we will not share that information.

What we use your information for

We use your information in line with our national policy.

Who we share your information with

We may share anonymised information with third parties, such as funders or partner organisations. Any information shared in this way will be anonymised so that individuals cannot be identified.

Our lawful basis for using your information

Article 6(1)(f) – Legitimate interests

We have a legitimate interest to carry out statistical analysis and research using our client data. We have carried out a legitimate interest assessment for statistical processing, research and policy formation. We may also keep pseudonymised data for archival purposes.

How we use your data when applying to work or volunteer

How we collect your information

We collect information directly from you when you apply for a role, complete application forms, submit a CV, attend interviews, or communicate with us by email, phone, or in person. We may also collect information from third parties where relevant to the recruitment process, such as referees, previous employers, training providers, or the Disclosure and Barring Service (DBS).

What information we collect

The information we collect may include:

Your name, contact details, and date of birth
Employment history, qualifications, skills, and experience
Information provided in your CV, application form, or interview
Right‑to‑work documentation
References from previous employers or other referees
Information relating to criminal record checks (where required)
Any reasonable adjustments you may request for the recruitment process
Equal opportunities monitoring information (where collected, this is anonymised and not used in decision‑making)

What we use your information for

We use your information to:

Assess your suitability for the role you have applied for
Contact you about your application and arrange interviews
Verify your identity, qualifications, and employment history
Carry out DBS checks where required for safeguarding or legal compliance
Obtain references from previous employers or nominated referees
Make decisions about shortlisting and appointment
Maintain records of the recruitment process
Meet our legal, regulatory, and safeguarding obligations

We will not use your information for any purpose unrelated to your application.

Who we share your information with

We may share your information with:

Referees and previous employers to obtain references
The Disclosure and Barring Service (DBS) where a check is required
External recruitment platforms or HR systems we use to manage applications
Professional bodies or qualification providers where verification is required
Our legal or safeguarding advisers where necessary
Regulatory bodies where we are legally required to do so

We do not sell your information or share it for marketing purposes.

Our lawful basis for using your information

We rely on the following lawful bases under the UK GDPR:

Article 6(1)(b) – Contract: Processing is necessary to take steps at your request prior to entering into a contract of employment or volunteering agreement.
Article 6(1)(c) – Legal obligation: For example, verifying your right to work or carrying out DBS checks where required.
Article 6(1)(f) – Legitimate interests: For managing and improving our recruitment processes and ensuring we appoint suitable candidates.
Article 9(2)(b) and (h) – Employment and safeguarding obligations: For processing special category data such as health information or criminal record data where required by law or for safeguarding purposes.

How we use your data when using our website

What information we collect

We collect the following information when you use our website:

Basic technical information such as IP address, browser type, device information, and pages visited
Information you provide through online forms (e.g., contact forms, feedback forms, volunteering enquiries)
Any information you choose to send us by email via the contact links on the site
Cookie data that helps us understand how visitors use our website

We do not collect special category data through the website unless you choose to provide it in a form or email.

How we collect your information

We collect information in the following ways:

Automatically, through cookies and analytics tools when you browse the site
Directly from you, when you complete an online form or contact us by email
Through server logs, which record basic technical information for security and performance monitoring

We do not use automated decision‑making or profiling on our website.

What we use your information for

We use the information collected on our website to:

Respond to enquiries submitted through online forms or email
Improve the performance, accessibility, and security of our website
Understand how visitors use the site so we can improve content and navigation
Meet our legal obligations, including data protection and safeguarding requirements
Monitor website traffic and detect any malicious activity

We do not use your information for marketing, and we do not sell or trade your data.

Who we share your information with

We only share website‑collected information with:

Our website hosting provider, for the purposes of maintaining and securing the site
Analytics providers (e.g., Google Analytics) if enabled, to help us understand website usage
Citizens Advice national IT services, where required for security or technical support
Law enforcement, only if legally required (e.g., safeguarding, fraud, or criminal investigations)

We do not share your information with advertisers or unrelated third parties.

Our lawful basis for using your information

Under UK GDPR, our lawful bases for processing website‑related information are:

Legitimate interests – to operate, maintain, and improve our website, ensure security, and respond to enquiries
Consent – for optional cookies and analytics tools (you can withdraw consent at any time)
Legal obligation – where we are required to retain or disclose information for safeguarding, fraud prevention, or regulatory compliance

How we use cookies on our website

Our website uses cookies to:

Ensure the site functions correctly
Improve performance and user experience
Collect anonymous analytics data (if enabled)
Remember your cookie preferences

Types of cookies we may use:

Strictly necessary cookies – required for the website to work
Analytics cookies – help us understand how visitors use the site
Functionality cookies – remember your preferences

You can manage or disable cookies at any time through your browser settings.

For more information about cookies and your rights, – the ICO has more guidance on cookies compliance

How long we keep your data for

National Citizens Advice is responsible for managing any data in joint client case records. For more information please see their privacy notice.

For data collected through our local website, we only keep information for as long as it is needed for the purpose it was collected. This includes:

Website enquiries and contact forms

Information submitted through online forms or email links is kept only for the time required to respond to your enquiry and provide any follow‑up support.
We normally retain this information for up to 12 months, unless your enquiry becomes part of a formal complaint or safeguarding matter.

Technical data (cookies, analytics, server logs)

Technical information such as IP addresses, browser type, and website usage data is kept for no longer than 26 months, depending on the type of cookie or analytics tool used.
Some essential cookies are deleted as soon as you close your browser.

Email correspondence

Emails sent to our organisational inboxes are retained for up to 2 years, unless they relate to safeguarding, complaints, or legal matters, in which case they may be kept longer in line with statutory requirements.

Safeguarding or legal matters

Where information relates to safeguarding, fraud, or other legal obligations, we may need to retain it for longer in accordance with UK law and regulatory requirements.

We regularly review the information we hold and securely delete or anonymise data when it is no longer needed.

Third party processors

Third party processors are other organisations that carry out data processing on our behalf. Third party processors don’t use data for their own purposes and we have agreements in line with data protection law.

Processor name	Activities	Data hosting location
Google Workspace	Data storage	Virtual
Gov.uk	DBS check provider	Virtual

Your data protection rights

You have rights in relation to your personal data that we hold. Your rights include being able to request:

Access to copies of your data
Corrections are made to inaccurate data
Deletion of your personal data
Object to how we use your personal data

These rights are not absolute and may not apply in every circumstance. For more information about your rights you can visit the ICO website.

To make a data protection rights request you can do so by emailing admin@cabconwygwynedd.cymru.

Raising a concern about how we use your information

If you are concerned about how we have handled your personal information please contact us at admin@cabconwygwynedd.cymru.

You can also contact the national charity if you are unhappy with how we have used your personal data or wish to raise a concern about how a local office has handled your personal data. To do so you can email us at DPO@citizensadvice.org.uk

Contacting the Information Commissioner’s Office (ICO)

You can also raise your concern with the Information Commissioner’s Office which regulates data protection law in the UK. if you are unhappy with how we have used your personal information. They will normally expect you to have made a complaint to us directly in the first instance.

Visit the ICO website.
Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Helpline number: 0303 123 1113