Citizens Advice Sutton Privacy Policy

At Citizens Advice Sutton we collect and use your personal information to help solve your problems, improve our services, and tackle wider issues in society that affect people’s lives. We only ask for the information we need. We always let you decide what you’re comfortable telling us, explain why we need it and treat it as confidential. When we record and use your personal information, we:

  • Only access it when we have a good reason.
  • Only share what is necessary and relevant.
  •  Don’t sell it to anyone.


We collect and use the details you give us so we can help you. We have a ‘legitimate interest’ to do this under data protection law. This means it lets us carry out our aims and goals as an organisation. We will always explain how we use your information. At times we might use or share your information without your permission. If we do, we will always make sure there is a legal basis for it. This includes situations where we must use or share your information:

  • To comply with the law - for example, if a court orders us to share information. This is called ‘legal obligation.’
  • To protect someone’s life - for example, sharing information with a paramedic if a client was unwell at our office. This is called ‘vital interests.’
  • We share client information with National Citizens Advice for the purposes for quality assurance. We have a ‘legitimate interest’ in sharing this information, that of carrying out our legitimate aims and goals as a charity.
  • For us to carry out a task where we are meeting the aims of a public body in the public interest - for example, delivering a government or local authority service. This is called ‘public task.’
  • To carry out a contract we have with you - for example, if you’re an employee we need to store your bank details so we can pay you. This is called ‘contract.’
  • To defend our legal rights - for example, sharing information with our legal advisors if there was a complaint that we gave the wrong advice.


We handle and store your personal information in line with the law - including the UK General Data Protection Regulation and the Data Protection Act 2018. You can check the main national Citizens Advice policy for how we handle most of your personal information. This page covers how we, as your local charity, handle your information locally in our offices.

How Citizens Advice Sutton collects your data

We are relying on the legal basis of legitimate interest to collect information.  We collect information that you provide.  We may keep a record of any information that you provide unless you tell us otherwise. We also record information about you from third parties you use authorise us to contact to help resolve your advice issue.

Special Category Data

We may, to help you and to ensure that we are providing a service for everyone, record ‘special category’ data such as race, religion or belief, sexual orientation, or health issues. Our legal basis for processing special category data is explicit consent. We may ask you to give explicit consent verbally or in writing.

What Citizens Advice Sutton asks for

To find out what information our advisers will ask you for, see our national Citizens Advice Privacy Policy.  

How Citizens Advice Sutton uses your information

To find out how we use your information, see our national Citizens Advice Privacy Policy’.

Working on your behalf

When you give us authority to act on your behalf, for example to help you with a Universal Credit claim, we will need to share information with the appropriate third party such as the Department of Work and Pensions, the local authority, or any other organisation that you have authorised us to contact on your behalf. We need your written authorisation to contact third parties on your behalf.

How Citizens Advice Sutton stores your information 

We will unless you ask us not to store your information on our case recording systems. We may store your information on or more of these systems.

  • We store most client records on our Charitylog system, a database controlled by Citizens Advice Sutton.
  • We store our debt work on the Advicepro system provided by Toynbee Hall, subject to the Toynbee Hall Privacy Policy.
  • If you have accessed the Pension Wise service, please see the Money Helper Privacy Notice.
  • We may also keep hard copy records which we store securely in locked cabinets.
  • We may also store information such as correspondence with your or on your behalf, on secure Office 365 applications.


How Citizens Advice Sutton shares your information

With your permission, we might share your information with other organisations so we can:

  • Help solve your problem - for example, if you ask us to contact your creditors, we need to share your name, address, and financial details with them.
  • Refer you quickly to another organisation for more advice or support, if relevant.
  • Help you access certain services – such as a food banks.

Organisations we share your data with must store and use your data in line with data protection law. They will have their own privacy policies for how they handle your information and keep it safe.

Contact Citizens Advice Sutton about your information.

If you have any questions about how your information is collected or used, you can contact our office. Telephone 020 8405 3552, Monday to Friday 9.00 am to 5.00 pm. You can also contact us online.

You can contact us to:

  • Find out what personal information we hold about you.
  • Correct your information if it’s wrong, out of date or incomplete.
  • Request we delete your information.
  • Ask us to limit what we do with your data - for example, ask us not to share it if you haven’t asked us already.
  • Ask us to give you a copy of the data we hold in a format you can use to transfer it to another service.
  • Ask us to stop using your information.


Who’s responsible for looking after your personal information.

Each local Citizens Advice is an independent charity, and a member of the national Citizens Advice charity. The Citizens Advice membership agreement also requires that the use of your information complies with data protection law.

You can find out more about your data rights on the Information Commissioner’s website