February 2026
At Citizens Advice North East Derbyshire (CA NED), we collect and use your personal information to help solve your problems, improve our services and tackle wider issues in society that affect people’s lives.
This privacy policy explains how we use your information and what your rights are. We handle and store your personal information in line with data protection law and our confidentiality policy. The following pages tell you more about how we use your information in more detail.
Our network
Citizens Advice is a membership organisation made up of the national Citizens Advice charity and many local offices across England and Wales, including CA NED. CA NED is an independent charity and a member of the national Citizens Advice charity.
All members of the Citizens Advice network are responsible for keeping your personal information safe and making sure data protection law is followed.
Members of the network also run some jointly designed services and use some of the same systems to process your personal data. In these instances we are joint data controllers for these activities.
Jointly controlled data
All offices in the Citizens Advice network use some joint systems to carry out our activities. These include joint case management systems, telephony platforms and more.
Staff from a different local Citizens Advice can only access your personal information in a joint system if they have a good reason. For example when:
- you go to a different office to seek advice
- more than one office is working together in partnership
- they need to investigate a complaint or incident
We have rules and controls in place to stop people accessing or using your information when they shouldn’t.
Tell an adviser if you’re worried about your details being on a national system. We’ll work with you to take extra steps to protect your information – for example by recording your problem without using your name.
National Citizens Advice has a privacy notice available on their website that covers general advice and nationally managed systems, including our case management systems. This policy covers the processing we carry out in our office.
How we use your data for advice
This section covers how we use your data to provide you with advice.
For general advice and nationally funded advice programmes please see the national Citizens Advice privacy notice.
How we collect your information
When we provide advice we either collect this data directly from you or receive it through a referral from a partner organisation.
We will collect this data in different ways depending on how you approach our service, including:
- face to face – for example by discussing your situation with an advisor
- completing a form – this could be a digital form or paper form
- over the phone – for example by calling Adviceline or a local office directly
We also receive information from partner organisations through referral mechanisms. Where you are referred to us, you should be advised that you are being referred as well as what information we will be provided by our referral partners.
What information we collect
To support your enquiry we collect information about you and your circumstances. You can choose which information you give us, but not providing certain information may limit the advice we can give you. This may include:
- your name – you can ask to remain unnamed but this may limit the advice we are able to provide
- contact details such as your address, phone number and email address
- profile information such as your date of birth and whether you have any accessibility requirements
We will also collect any information about your issue which could help us provide you with advice which can include:
- information about your finances – for example your income, expenditure, debts, benefits or pension
- credit reports – we may get copies of your credit history with your permission
- details of the products or services you are having issues with
- details of your housing such as your rent, mortgage and housing conditions
- information about your health or disability
- details of any discrimination you face
If you contact us by phone we will also record the phone call for training and monitoring purposes.
You may also be asked to provide demographic information at your advice session. This will not affect the advice you receive and will be used to understand more about our service. For more information see the section on statistical processing.
Information about third party individuals
We may also gather information about you if you aren’t one of our clients. We will do this if it is relevant to provide a client with advice. For example, to assist a client with a debt assessment we will need relevant financial information about members of their household.
What we use your information for
We use the information you give us to:
- provide you with advice, guidance and information
- stay in touch with you about the advice we are providing
- help with applications such as a debt recovery order or benefit claim
- training our staff and volunteers
- assess the quality of our advice
- investigate complaints or claims
- get feedback from you about our services
- help us improve our services
- address the root causes of the issue you are experiencing
- share stories about your experience with Citizens Advice, with your permission
We may also record any unacceptable behaviour from clients if we deem this to cause disruption to our service or threaten the wellbeing of our staff, volunteers or any other person.
In some circumstances we may also use your information to carry out legal obligations, including for:
- safeguarding
- fraud prevention
- regulatory compliance
Our confidentiality policy
At Citizens Advice we have a confidentiality policy which states that anything you tell us as part of advice will not be shared outside of the Citizens Advice network unless you provide your permission for us to do so.
There are some exceptions to this such as needing to share:
- to prevent an immediate risk of harm to an individual
- In select circumstances if it is in the best interests of the client
- where we are compelled to do so by law (e.g. a court order or meeting statutory disclosures)
- where there is an overriding public interest such as to prevent harm against someone or to investigate a crime
- to defend against a complaint or legal claim
- to protect our name and reputation for example to provide our side of a story reported in the press
Who we share your information with
In addition to the categories of recipients below, we may also ask to refer you to another organisation who we think will be able to provide you with more support. We will ask your permission to make any such referral.
Referral partners
We will share your information with partners when we want to refer you to another service. This may be as part of a jointly run service or where we believe another organisation may be better placed to provide you with the advice you need. We will only make a referral when you have given us your permission to do so.
Some established referral partners include:
- Derbyshire Law Centre – for specialist advice
- Marches Energy Agency – to issue you with a fuel voucher
- Welfare Rights, Derbyshire County Council – for appeal representation
- Trussell Trust – to issue you with a food bank voucher
- Fuel bank foundation – to issue you with a fuel voucher
- Gam Care – for support with gambling issues
Funders
We share information with our funders in order to demonstrate that we are meeting the funding requirements. Information will normally only be shared in a de-identified manner unless you give us your permission to do so or we need to in order to investigate a quality issue, complaint or claim or to provide feedback.
Regulators
We are legally required to provide information to regulatory bodies in some circumstances. These include but are not limited to:
- Ofgem – the regulator for gas and electricity
- Ofcom – the regulator for the broadcasting, telecoms and postal industry
- the Financial Conduct Authority – the regulator for financial and banking services
- the Competition and Markets Authority
- Trading Standards
Auditors
We share information with our internal and external auditors to allow them to carry out audits to ensure that we are complying with our legal obligations and standards of best practice in how we run the organisation.
Banks, credit reference agencies and creditors
We may also share your information with banks or creditors to help get information to assist in our advice. We will only do this with your permission or where we are legally required to do so. Information we share will be used for purposes including:
- getting a credit report to assist with financial enquiries
- understanding more about your income and expenditure
- understanding more about the debts you owe
Employers or benefit providers
We may also contact your employer or benefit provider to understand more about your income, we will only do this with your permission.
Translation and interpretation services
We may share your information with a translation or interpretation service to enable us to communicate with clients who prefer communication in different languages.
Our lawful basis for using your information
| Activity | Lawful basis for collecting personal data | Lawful basis for collecting special category or criminal convictions data |
|---|---|---|
| General advice provision and funded services (unless listed below) | Legitimate interests – we have a legitimate interest to provide advice to our clients | Establishment, exercise or defence of legal claims – where we are helping clients establish their legal rights
Substantial Public Interest (provision of confidential counselling, advice or support) – where we are providing advice to clients which doesn’t relate to their legal rights. |
| Debt relief orders | Public task – we have a public task through our funder the Money and Pensions Service to assist with debt relief orders | Establishment, exercise or defence of legal claims – where we are helping clients establish their legal pension rights |
| Accessibility requirements | Legal obligation – we have legal obligations in accordance with the equalities legislation | Substantial public interest (statutory obligation) – obligations under equalities legislation. |
| Marketing new advice services | Legitimate interests – we have a legitimate interest in promoting advice services which could benefit our clients
Consent – where marketing rules require consent to do so |
N/A |
| Maintaining quality and standards | Legitimate interests – we have a legitimate interest in ensuring that our service is run properly and that standards are maintained | Establishment, exercise or defence of legal claims
Substantial public interest (protecting the public against dishonesty etc) – where we are carrying out functions to protect against: |
| Safeguarding | Public task – in complying with safeguarding obligations | Substantial public interest (Safeguarding of children and of individuals at risk) |
| Fraud prevention | Legitimate interests – we have a legitimate interest in defending against fraudulent activity
Legal obligation – in some circumstances there are legal obligations to disclose actual or suspected cases of fraud |
Substantial public interest – (preventing and detecting unlawful acts, preventing fraud, Suspicion of terrorist financing or money laundering) |
How we use your data for research, feedback and statistics
Our use of data for this purpose is covered in the National Citizens Advice privacy notice.
How we use your data for fundraising and donations
Our use of data for this purpose is covered in the National Citizens Advice privacy notice.
How we use your data when applying to work or volunteer
How we collect your information
We collect information about you through your job or volunteer application form.
Depending on the role we may also collect information through a Disclosure and Barring Service (DBS) check. You will be informed if such a check will be required for the role at application stage.
What information we ask for
We’ll collect personal information such as name, address, telephone number and email address, previous job history and experience, qualifications, and any support needs you may have.
We’ll also ask for diversity information like your gender, ethnicity and sexual orientation. You don’t have to tell us this.
Where it’s needed for the role, we might contact the DBS for a criminal record check. Once the DBS check is completed and you’ve received your certificate, we’d expect you to share this information with us as part of the background check process.
We may also ask for:
- references for your previous and current work
- proof of your right to work in the UK, like a valid UK passport or visa
- your national insurance number and P45
- your bank details, so we can pay you
- details of your student loan if you’re paying one back
What we use your information for
The main reasons we ask for your personal information are to:
- check you’ve got the right skills for a role when you apply
- arrange an interview
- contact you to tell you the result of your application
- do checks when we make an offer, for example contacting your references or checking your right to work in the UK
- send you an offer letter or contract
We’ll treat any diversity information you give us as strictly confidential. We’ll anonymise this information and only use it to look at trends. This means we won’t look at your information individually or compare it to other people and we won’t use it as part of the recruitment selection process.
We run a guaranteed interview scheme for people with disabilities. The hiring manager and the recruitment team will see your application if you applied using this scheme. They will treat this information as strictly confidential and they won’t be able to see the rest of your diversity information. This information won’t be used in making any other decisions about your application.
Who we share your information with
If you accept an offer to work for us we’ll:
- get your permission to share your information with your references
- share your contact information with our occupational health provider, Health Management
We won’t usually share your personal information with anyone else in a way that could identify you. In some rare situations we have to share your information, for example if:
- we’re investigating a safeguarding issue
- the police ask for the information to help them investigate a crime
- a court orders us to share the information
| Activity | Our lawful basis for collecting personal data | Our lawful basis for collecting special category or criminal convictions data |
|---|---|---|
| Recruitment of staff | Legitimate interests – for assessing suitability of candidates
Contract – for entering an employment contract Legal obligation – for carrying out legal checks as part of employment screening |
Employment, social security, and social protection – for complying with legal requirements as an employer including DBS checks |
| Recruitment of volunteers | Legitimate interests – for assessing suitability of candidates
Legal obligation – for carrying out legal checks as part of employment screening |
Employment, social security, and social protection – carrying out DBS checks |
How we use your data for Artificial Intelligence (AI) Tools
At Citizens Advice North East Derbyshire (CA NED), we are committed to protecting the privacy and confidentiality of all information. When utilising Artificial Intelligence (AI) tools, our practice is strictly limited to supporting internal operations and content creation, maintaining the highest standards of data protection and security in compliance with UK GDPR.
1. Scope of AI Use and Data Exclusions
Our commitment to data security starts with a clear definition of what AI tools can and cannot be used for:
- Inclusions (Written Content Generation): AI may be used for drafting external communications (e.g., social media posts, press releases, website articles, marketing materials), internal communications, training documents, summaries of public information, reports, meeting transcriptions and summarisation, and general administrative content.
- Exclusions (Prohibited Use): AI will never be used for the following:
- Processing, summarising, or managing identifiable client case data stored in our case management systems.
- Data analysis involving any personally identifiable client information.
- Giving direct advice to clients, unless the AI output is part of a formal, manager-approved pilot program (e.g., the CADDY pilot managed by Citizens Advice SORT), and is subject to mandatory verification and final sign-off by a trained, authorised human adviser.
2. Data Minimisation and Anonymisation
We apply the principle of data minimisation to ensure confidentiality is preserved for all individuals associated with CA NED:
- No Personal Data Input: Staff and volunteers are strictly prohibited from inputting any identifiable personal data (client, staff, or volunteer sensitive personal information, or specific case notes) into the AI tool (e.g., Gemini) for content generation.
- Anonymisation Standard: If the AI is used to process internal data for purposes like drafting reports or summarising meeting notes, that data will be fully anonymised or fictionalised before it is input into the tool. Any meeting transcription containing names or personal opinions must be reviewed and anonymised immediately upon creation if it is to be processed further by the AI.
3. Tool, Security, and Oversight
We ensure that the tools we use adhere to strict security and accountability standards:
- AI Tool: We use the Gemini model, which is provided within our secure Google Workspace package.
- Security: Technical and contractual safeguards are in place. Data and prompts processed by Gemini within our Google Workspace are kept within a secure, encrypted environment and are not used by the third-party AI provider to train or improve their commercial AI models.
- Human Oversight: Every piece of written content generated by AI is subject to human review and verification by a trained member of staff or volunteer to ensure accuracy, tone, and compliance with Citizens Advice standards before its final use.
4. Accountability and Legal Compliance
Citizens Advice North East Derbyshire remains the Data Controller for all personal data processed. A Data Protection Impact Assessment (DPIA) has been conducted to manage the specific risks associated with using AI for written content generation under this scope, ensuring full compliance with data protection laws.
How we use your data when using our website
What information we collect
When you use our website we may collect information about you. This can include information:
- that you provide directly to us in forms
- about how you use our website
- about your geographical location
How we collect your information
As well as data that you give us directly through a form or webchat, we use technology called cookies to gather information about how you’re using our website – for example, what pages you click on and what device you’re using. This helps us improve your experience of our website.
What we use your information for
We use information about how you use our website in order to improve our services and inform our campaigns.
If you provide information so that you can get advice through our contact page, you should read about how we use your information for advice.
We also gather feedback through forms embedded into the website. If you complete any of our forms we will use your information to improve the site and the services we provide.
Who we share your information with
We don’t share any website user information with any external organisation apart from our third party processors, who only use the data on our behalf.
Our lawful basis for using your information
| Activity | Our lawful basis for collecting personal data | Our lawful basis for collecting special category or criminal convictions data |
|---|---|---|
| Website use monitoring | Legitimate interests | N/A |
How we use cookies on our website
Any information that we collect through the use of cookies is completely anonymous and not personally identifiable. Our systems will not store your name, address, telephone number, or email address unless volunteered to us by you. This shall be treated as proprietary and confidential; we do not sell or share your details with any third parties. Additionally, none of the cookies we use gather any information that can be used to advertise services or products to you from our or any other website.
The EU Cookie Law (The Privacy and Electronic Communications Regulations 2011) is a new piece of privacy legislation that requires visitors to give consent before allowing a website to store or retrieve any information from any device through the use of cookies. By educating visitors on how information about them is collected through the use of cookies, and allowing them to decide for themselves if they wish to allow it to take place, the aim is to protect online privacy for everyone.
What are Cookies?
Cookies are small text files, downloaded to your computer by the browser (e.g. Internet Explorer, Firefox etc.) whenever you access a website. They enable websites to store such information as user preferences and login details. They may also be used to record how long you spend browsing each page on a site or what pages you visit most. Cookies can be thought of as providing a “memory” for the website, enabling it to recognise you and respond appropriately. Generally, cookies are most beneficial to you, the visitor, making your interaction with frequently-visited sites smoother and easier than they would be without them.
How our website uses Cookies
Website statistics
We use Google Analytics and Google Ads Remarketing Tracking Code, third party services which creates its own set of cookies for the purpose of compiling a number of statistical reports. The information gathered is completely anonymous and is used to assess a wide variety of website activities, including how our site is navigated and what pages are most popular. If you would prefer that Google did not track about your browsing habits, you can install a browser add-on to opt-out.
Social media
We may also use a number of third party, social media plug-ins including but not limited to Google’s ‘+1’ button, Facebook’s ‘Like Box’, Twitter’s ‘Follow Button’ and LinkedIn’s ‘Share’ and ‘Follow’ buttons. We use these services for the convenience of our visitors, allowing them to access up to the minute information as well as recommend our services to others. To learn more about each organisations’ privacy policies, please visit the links provided below:
How to disable Cookies
By continuing to browse this site you are agreeing to our use of cookies as described above. However you can still disable cookies at a browser level if you wish. You may experience reduced functionality if you choose to do so. The settings that decide how your browser handles cookies will typically be found in the ‘Options’ or ‘Preferences’ menu of your browser. In order to understand these settings, the following links may be helpful; otherwise you should use the ‘Help’ option in your browser for more details.
- Cookie settings in Internet Explorer
- Cookie settings in Firefox
- Cookie settings in Chrome
- Cookie settings in Safari
How long we keep your data for
This is covered in the National Citizens Advice privacy notice.
Third party processors
This is covered in the National Citizens Advice privacy notice.
We have data sharing agreements for any additional third party processors.
Your data protection rights
You have rights in relation to your personal data that we hold. Your rights include being able to request:
- Access to copies of your data
- Corrections are made to inaccurate data
- Deletion of your personal data
- Object to how we use your personal data
These rights are not absolute and may not apply in every circumstance. For more information about your rights you can visit the ICO website.
To make a data protection rights request you can do so by emailing mail@nedcab.org.uk
Raising a concern about how we use your information
If you are concerned about how we have handled your personal information please contact us at mail@nedcab.org.uk
You can also contact the national charity if you are unhappy with how we have used your personal data or wish to raise a concern about how a local office has handled your personal data. To do so you can email us at DPO@citizensadvice.org.uk
Contacting the Information Commissioner’s Office (ICO)
You can also raise your concern with the Information Commissioner’s Office which regulates data protection law in the UK, if you are unhappy with how we have used your personal information. They will normally expect you to have made a complaint to us directly in the first instance.
- Visit the ICO website.
- Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
- Helpline number: 0303 123 1113
