Privacy Policy

Privacy Policy

At Kincardine and Mearns CAB, we collect and use your personal information to help solve your problems, improve our services and tackle wider issues in society that affect citizens in Scotland.

We only ask for the information we need, let you decide what you're comfortable telling us, and explain why we need it. We also treat it as confidential.


When we record and use your personal information we:

  • only access it when we have a good reason
  • only share what is necessary and relevant
  • don't sell it to anyone


We handle and store your personal information in line with the law. If we need to record any sensitive information, we will get your consent to do so. You can withdraw your consent at any time by contacting Kincardine and Mearns CAB


Who's responsible for keeping your personal information safe?

Citizens Advice Scotland and Kincardine and Mearns CAB are both responsible for keeping your personal information safe and making sure we comply with data protection law. This means we are 'joint data controllers' for your personal information.

Each local Citizens Advice Bureau is an independent charity and along with Citizens Advice Scotland (CAS), is a member of the Scottish Association of Citizens Advice Bureaux (SACAB). This means we use your information for monitoring purposes, our research and campaigning work and to keep improving our service for citizens in Scotland.


Working on your behalf

When you give us authority to act on your behalf, for example to help you with a Universal Credit claim, we’ll need to share information with that third party.


When we would use your information without your permission

At times we might need to use or share your information without your permission. If we do, we'll always make sure there's a legal basis for it. This could include situations where we have to use or share your information:

  • to comply with the law, called 'legal obligation' - for example, if a court orders us to share information
  • to protect someone's life, called 'vital interests' - for example, sharing information with a paramedic if a client was unwell at the bureau or one of our outreaches
  • to carry out our aims and goals as an organisation, called 'legitimate interests' - for example, to create anonymous case studies and statistics for our national research
  • for us to carry out a task in the public interest or for our official functions, and the task or function has a clear basis in law, called 'public task' - for example the Consumer Service
  • to carry out a contract we have with you, called 'contract' - for example, if you're an employee we might need to store your bank details so we can pay you
  • to defend our legal rights - for example, to resolve a complaint that we gave the wrong advice


What are my rights?

You have rights under data protection law that relate to the way we process your personal data. More information on these can be found on the Information Commissioner’s website. If you would like to exercise any of these rights, please contact  Kincardine and Mearns CAB. 


Your rights include:

  • the right to access the personal information that we hold about you
  • the right to ask us to correct any inaccurate personal information we hold about you
  • the right to ask us to erase any information we hold about you, although this will only apply in certain situations due to us processing your data on the basis of ‘legitimate interests’
  • the right to restrict our processing of the personal information we hold about you. This will only apply in situations such as:
    • you are disputing the accuracy of the information we hold
    • where we no longer need to use the information but it is needed for legal claims
  • the right to receive personal information, which you have provided to us, in a structured commonly used and readable format


What we do with your information

First and foremost, your information will be used to provide you with advice. This also includes us sharing anonymised statistical data that we can use for research purposes to show the value and impact of our service to funders and others who are interested in our work, such as external auditors who want to make sure we are giving you high quality advice. We may also use it to refer you to any specialist services out with SACAB. A record of your case will be kept on our secure electronic case management system and in secure filing cabinets for the time that your case is open with us. 


Our services are also subject to external audit by the Scottish Legal Aid Board (SLAB). They check that we are providing you with the highest quality of service and are allowed to access your information (if randomly selected) under the legal basis of ‘public task’.



Who We Are and Important Information

Kincardine and Mearsns CAB is the controller and responsible for your personal data and it is a member of the Scottish Association of Citizens Advice Bureau (“Cas”), details of which can be found on its website privacy policy (collectively referred to as "we", "our", "us" or "Cab").  This Privacy Notice sets out the type of personal information we collect about you, why we collect it, and how we use it when you use our chatbot service. 

It is important that you read this Privacy Notice together with our website privacy policy which contains more detailed information about our data processing and can be accessed here or you can request a copy from us. 

If you have any queries about our privacy practices or about this Privacy Notice contact us:

Address: Sheriff Court Building, Dunnottar Ave, Stonehaven, AB39 2JD



What Personal Data we collect and how this is collected

We collect personal data such as:

  •  your phone number 

  • information you provide us within the free text facility within the chat

  • the transcript of the chat. 


Purposes of using your Personal Data and lawful basis we rely on

We use your personal data to: 

  • provide you with the chatbot service  

  • learn from and improve the service

  • share the data with CAS and our third party chatbot supplier to facilitate improvement of services and wider development of services for fellow members of shared services

  • manage our relationship with you e.g. to contact you where you request this 

  • meet our regulatory requirements or legal responsibilities, as required.


We will only use your personal data when the law allows us to. Our lawful basis to process your personal data is in our legitimate interests. It is in our legitimate interest to respond to enquiries, requests, and information received to ensure we provide you with the relevant support, improve the service and share personal data with our third party chatbot supplier  which helps us to provide and improve the service.   


Who do you share my information with?

We may share your personal data with CAS, our third-party supplier who helps us develop, improve and supply the chatbot service, and other local Citizen's Advice Bureaus to provide you with the correct advice and/ or support. We also share this data with Google Cloud, insurers, and regulators.  


Personal Data Transfers

We transfer personal data to and from the EEA and UK based on the adequacy decisions for the UK and EU. Please see our  website privacy policy.


How long do we keep records for?

We will only keep your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including to satisfy any legal, insurance, regulatory, tax, accounting, or reporting requirements or if there’s a complaint or if we reasonably believe there is a prospect of litigation. 

If you chose not to get in touch with us after the chat has ended we’ll keep the data from the chat for 3 months. Where you get in touch with us we keep this for 7 years and for certain complex cases we keep this data for 16 years. 

We may keep data longer than these periods if necessary. Examples of where records need to be kept beyond the retention periods include records of advice and support around statutory debt options and building works over a certain value.


Your Legal Rights

Under certain circumstances, you have rights under data protection laws concerning your personal data including the right to receive a copy of the personal data we hold about you, the right to rectification, restriction, erasure, objection, as well as the right to portability. You also have the right to make a complaint at any time to a supervisory authority which is the Information Commissioner's Office in the UK and is the regulator for data protection issues (