Privacy Notice

Last updated: 15 September 2025

This Privacy Notice applies to citizens and lawful permanent residents of the United Kingdom and is issued by Citizens Advice Staffordshire South West (“we,” “us,” or “our”) in our capacity as data controller under the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018.

This Notice explains how we collect, use, disclose, and safeguard your personal data when you interact with our services through https://citizensadvicessw.org.uk.

We are committed to processing personal data lawfully, fairly, and transparently. Specifically:

• We clearly identify the purposes for which we process personal data.
• We only collect personal data that is adequate, relevant, and limited to what is necessary.
• Where processing is based on consent, we obtain your explicit, informed consent in advance.
• We implement appropriate technical and organisational security measures to protect personal data and require equivalent measures from our processors.
• We uphold your rights as a data subject under applicable law.

1. Purposes of Processing, Categories of Data, and Retention

We may collect and process personal data for the following purposes:

1.1 Contact and Correspondence

Categories of personal data:

• Name (first and last)
• Postal address
• Email address
• Telephone number

Lawful basis: Consent (Article 6(1)(a) UK GDPR)
Retention: Retained until the termination of the service or withdrawal of consent.

1.2 Compliance with Legal Obligations

Categories of personal data:

• Name (first and last)
• Postal address
• Email address
• Telephone number

Lawful basis: Legal obligation (Article 6(1)(c) UK GDPR)
Retention: Retained for as long as required to comply with statutory obligations.

1.3 Website Analytics and Performance Improvement

Categories of personal data:

• IP address
• Internet activity data (including browsing history, search history, and interactions with our website, applications, or advertisements)

Lawful basis: Consent (Article 6(1)(a) UK GDPR)
Retention: Retained for 14 months following termination of the service.

2. Data Sharing and Processors

We only disclose personal data to third-party processors engaged to provide services on our behalf, subject to written data processing agreements compliant with Article 28 UK GDPR.

3. Disclosures Required by Law

We may disclose personal data:

• To comply with legal or regulatory obligations, including court orders or requests from law enforcement authorities;
• Where disclosure is necessary in connection with the prevention or investigation of a crime or matter of public safety.

In the event of a merger, acquisition, or restructuring of our organisation, personal data may be transferred to advisers, counterparties, and any successor entity.

We have entered into a data processing agreement with Google. Google is not permitted to use personal data for unrelated services. We ensure that full IP addresses are anonymised prior to processing.

4. Data Security

We implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including safeguards against unauthorised access, unlawful processing, accidental loss, destruction, or damage. Access to personal data is restricted to authorised personnel only.

5. Cookies

Our website uses cookies and similar technologies. Please refer to our Cookie Policy for details of the types of cookies used, their purposes, and how you can manage your preferences.

6. Third-Party Links

This Privacy Notice does not extend to external websites accessed via links on our website. We accept no responsibility for the data processing practices of third parties. You should review their privacy notices before providing any personal data.

7. Amendments

We reserve the right to update or amend this Privacy Notice at any time. Please review it periodically. Where material changes are made, we will take reasonable steps to notify you.

8. Your Data Protection Rights

As a data subject, you have the following rights under the UK GDPR:

• Right to be informed – to know why personal data is collected, how it will be used, and the retention period.
• Right of access (Article 15) – to request confirmation of whether we process your data and obtain a copy of such data.
• Right to rectification (Article 16) – to request the correction or completion of inaccurate or incomplete personal data.
• Right to erasure (Article 17) – to request deletion of personal data, subject to legal limitations.
• Right to restrict processing (Article 18) – to request that processing of personal data is limited in specific circumstances.
• Right to data portability (Article 20) – to request that your personal data be transferred to another controller in a structured, commonly used, machine-readable format.
• Right to object (Article 21) – to object to processing based on legitimate interests or direct marketing.
• Right to withdraw consent – where processing is based on consent, you may withdraw it at any time without affecting prior lawful processing.

Requests must include sufficient information to verify your identity and ensure that data relating to third parties is not disclosed or altered.

9. Children

Our website and services are not directed at children under the age of digital consent in their jurisdiction. We do not knowingly collect personal data from such individuals.

10. Complaints

If you believe your data protection rights have been infringed, you have the right to lodge a complaint with the supervisory authority:

Information Commissioner’s Office (ICO)
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Email: casework@ico.org.uk

11. Contact Details

For questions or to exercise your rights, please contact:

Citizens Advice Staffordshire South West
1a & 1b St Mary’s Place
Stafford
ST16 2AR

12. Full Privacy Policy

A downloadable version of our full Privacy Policy is available here.