We are committed to protecting your privacy.
West Dunbartonshire CAB (also referred to as ‘the Bureau’, ‘we’, ’our’, or ‘us’) is the Data Controller for any personal data we process about you for the purposes set out in this Privacy Notice. Our ICO registration number is Z7469524.
This notice outlines what personal data the Bureau collects and processes about you when seeking advice and assistance from the Bureau. This notice does not cover personal data we process about our staff, workers, trustees, volunteers, supporters, or donors. Please read this notice carefully to understand how we process and look after your personal data.
The Bureau is a member of the Scottish Association of Citizens Advice Bureaux (SACAB – operating name Citizens Advice Scotland), a network of 59 individual Citizens Advice Bureau. The Bureau uses a case management system called CASTLE. We are a Joint Controller with Citizens Advice Scotland (CAS) for the personal data held on this system.
Our Data Processing
West Dunbartonshire CAB is an independent Bureau that provides free, confidential, expert advice and assistance to help you resolve your problems. We deliver a holistic service and our data processing may vary depending on the support we are providing. We only use the personal data we need. Most personal data we process will have been provided by you during your discussions with our advisors. On occasion referrals are made to the Bureau from other organisations. They may share your personal data with us to help us provide you with advice and support. They should make you aware when this happens.
The Bureau processes personal data to keep records of the advice and support offered. This is to provide an effective and efficient service to you as well as for our insurance purposes. Personal data is any information that could be used to identify you. This may include:
- Name
- Address
- Phone number
- Financial data
- Criminal convictions data
You may also provide information such as your ethnicity, mental and physical health, political and philosophical beliefs, religion, trade union membership, genetics, sexual life or gender. This is called ‘special category data’ and we will only use this type of personal data where it is necessary for us to deliver services to you and where we are permitted by law.
If you do not want us to record and use your personal data, we can help you as best we can, but advice will be limited and general rather than specific to your circumstances.
The Bureau may also gather personal data for purposes such as research and advocacy, more information on our purposes for processing data can be found in Appendix 1.
Lawful reasons we rely on to process your information
We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances where:
- It is necessary for our legitimate interests to meet the aims of our organisation but respecting your interests and rights.
- You have given us your consent to process your personal data.
- Processing is necessary for us to perform a public task carried out in the public interest as set out in law.
When we process special category personal data, in addition to the above legal reasons we may process your special category data if:
- We have obtained your explicit consent
- There is a substantial public interest for us to do so
Please see the table below at Appendix 1 for further information on the lawful bases we may rely upon to process your personal data.
Withdrawing Consent
If we rely upon your consent to process your personal data, you may request to withdraw consent at any time by contacting us at which point we shall stop processing your personal data in that way. Please note that this does not affect the legality of our processing up to the date of you tell us you want to withdraw l consent.
Sharing Your Personal Data
We may need to share your persona data in the following situations:
- When you give us authority to work with organisations on your behalf
- To refer you to other supporting organisations
- If we need to share your information with other Bureaux
- With third party service providers delivering services for the Bureau (e.g. technology providers)
- With our professional advisors such as auditors, insurers and legal professionals
- With funders as part of research and advocacy work
- To meet our legal and regulatory obligations
If we do need to share personal data, we will have appropriate controls and processes in place through written contracts. Any data sharing will comply with data protection laws and where possible we will anonymise data prior to sharing it.
In exceptional circumstances where there is a high risk of harm to an individual, person-identifiable confidential information may be shared with third parties. We have strict Safeguarding procedures in place for when this may occur.
Our Policy for processing Special Categories of Personal data & criminal convictions data 
Transfers to third countries
We may transfer personal information outside the UK.
Some of our third-party service providers may process personal data we give them outside of the UK. If it is necessary to transfer your personal data outside the UK, then we will put in place additional measures to protect your personal data to ensure it remains protected.
Retention
We will not keep your personal data for any longer than we need it. All data will be securely disposed of once it is no longer needed.
Most client information is retained on our CASTLE system for 7 years, however under certain circumstances we are legally required to retain personal data for longer, for example if you have entered into a debt remedy your information is retained for up to 15 years.
Our Data Retention Policy
National Project Privacy Notices
We are involved in delivering national projects, these projects have their own privacy notices which explain how your personal data will be used if you receive support via the projects. These Privacy Notices are linked below:
Patient Advice and Support Service (PASS)
Your Data Protection Rights
Under data protection law, you have a number of rights which you can contact us to exercise. These are: rights when organisations process your personal information.
- Right of access to the data we process about you
- Right to rectification of any data we process that may be incorrect
- Right to erasure of data we process about you
- Right to restrict processing of data we process about you
- Right to object to the Bureau processing your data
- Right to data portability
- Right not to be subject to automated decision-making and profiling
Your ability to exercise depend on our reason for processing your personal data. Please contact Gareth King, our Senior Risk Information Officer at gareth@wdcab.co.uk if you wish to make a request.
Data Controller Contact Details
If you have any questions or queries or wish to exercise your data rights you shouldcontact the Bureau. If you have queries regarding CASTLE, our case management system, you should contact the Bureau in the first instance, however your query may be passed to CAS as a Joint Controller of the system. You can find information on CAS’s data processing on the CAS Privacy Policy.
Supervisory Authority Contact Details
You have the right to lodge a complaint to the Information Commissioner about the processing of your data. Their contact details are:
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow
Cheshire, SK9 5AF. Tel: 0303 123 1113. The website is at: https://ico.org.uk.
Changes
We reserve the right to amend this privacy notice from time to time.
Last Updated: 4 February 2025.
APPENDIX 1
What happens if you visit our website?
When you use this website, we take measures to ensure your information is private and secure.
When browsing our website, we collect 'cookies' to help us understand more about how our site is used by
visitors, and to develop and enhance our services to you - A 'cookie' is a bit of information kept on your computer. It tells us things like what device you're using and what pages you click on.
We use cookies to:
- track aspects of user visits, including the length of a user's visit, their browser, geographic location and the use of the search facility on this website
- remember users selected contrast and/or text resizing style preferences for this website
- When we would use your information without your permission
Security
Information you submit via this website is secure and is never shared to a third party unless as authorised by law. In order to prevent unauthorised access or disclosure, we have created physical, electronic and managerial procedures to safeguard the information we collect online.
Browser cookies
Most websites you visit will use cookies in order to improve your user experience by enabling that website to ‘remember’ you, either for the duration of your visit (using a ‘session cookie’) or for repeat visits (using a ‘persistent cookie’). New legislations means your website must make users aware if you use cookies and prompt them not to use cookies when viewing your site.
Cookies do lots of different jobs, like letting you navigate between pages efficiently, storing your preferences, and generally improving your experience of a website. Cookies make the interaction between you and the website faster and easier. If a website doesn’t use cookies, it will think you are a new visitor every time you move to a new page on the site. This can have an impact on sites that have log in areas where the user would need to create a new log in every time they moved from page to page.
Some websites will also use cookies to enable them to target their advertising or marketing messages based for example, on your location and/or browsing habits. Cookies may be set by the website you are visiting (‘first party cookies’) or they may be set by other websites who run content on the page you are viewing (‘third party cookies’). Websites which use Google Analytics to track visitor numbers are using cookies to monitor this information.
What is in a cookie?
A cookie is a simple text file that is stored on your computer or mobile device by a website’s server and only that server will be able to retrieve or read the contents of that cookie. Each cookie is unique to your web browser. It will contain some anonymous information such as a unique identifier and the site name and some digits and numbers. It allows a website to remember things like your preferences or what’s in your shopping basket.
What to do if you don’t want cookies to be set?
Some people find the idea of a website storing information on their computer or mobile device a bit intrusive, particularly when this information is stored and used by a third party without them knowing. Although this is generally quite harmless you may not, for example, want to see advertising that has been targeted to your interests. If you prefer, it is possible to block some or all cookies, or even to delete cookies that have already been set; but you need to be aware that you might lose some functions of that website.
How can I control cookies?
Web browser cookies - if you don’t want to receive cookies, you can modify your browser so that it notifies you when cookies are sent to it or you can refuse cookies altogether. You can also delete cookies that have already been set. If you wish to restrict or block web browser cookies which are set on your device then you can do this through your browser settings; the Help function within your browser should tell you how. Alternatively, you may wish to visit www.aboutcookies.org which contains comprehensive information on how to do this on a wide variety of desktop browsers.
Contacting us through LiveChat or our Social Media channels
In addition to our privacy policy, if you are contacting us on through our webchat service or through our social media channels, please familiarise yourself with their privacy and data retention policies before providing any personal or sensitive information, or if you have concerns about how your information will be used: LiveChat (www.livechat.com/legal/privacy-policy) Facebook/Instagram (www.facebook.com/privacy/policy) Twitter (twitter.com/en/privacy)
Links to other sites
This website contains links to external websites. Privacy policies on these sites may vary and, as such, we are not responsible for the content or privacy policies of these sites.
Changes to this Privacy Policy
We may revise this Privacy Policy from time to time to reflect changes in law or the platforms we delivers our services through. As a result, you should visit this page periodically to keep up to date with changes.