Privacy Policy


The Community Advice and Law Service is a charity (Registered Charity Number 1087214) and a Registered Company Limited by Guarantee 04096574) specialising in Social Welfare Law. Our Chief Executive is Kathryn Burgess –

We give advice on Debt, Welfare Benefits and Housing. We do not charge clients for using our service.

This Privacy Policy explains what personal data we may collect from/about you, what we do with your data, who we might share it with, and what rights you have in relation to data we hold about you. We value your privacy and we will always do our utmost to protect it. We will also always do our utmost to remain compliant with the relevant Data Protection regulations, such as the General Data Protection Regulation.

Throughout this policy, we refer to “CALS”, “the service” or just “us”, “we” or “our” etc. In these cases, we are referring to the Community Advice and Law Service. Where we mention “you” or “your”, we’re talking about the data subject, service user, or anyone we might hold data about. We call the people who use our service “clients”.

If you want to talk to someone about what information we hold about you, or if you want us to stop contacting you, please contact us on 0116 242 1120.

Person responsible for data protection

Kathryn Burgess is the Executive Director of the Community Advice and Law Service and has overall responsibility for data protection.

What Information will we collect about you?

We will collect different information depending on why you have contacted us, what sort of case you have, and how much work we do with you. This also depends upon what information you choose to share with us, although some information is essential to enable us to provide the assistance that you request from us. .

You are under no obligation to provide us with your personal data, but we may not be able to provide some of our services to you without this information.

Contacting us for the first time

When you first contact us we will need to collect and record at least your name and contact details so that we can get in touch with you about your case and make an appointment etc. If you make contact via our website, via e-mail, or if you leave us a voicemail message or send us a letter, the information you submit will be stored on our computer systems, and we may use this to contact you at a later date. Depending on the amount and type of help you need, we may open a case file and we would therefore include this information in your case file.

Initial Assessment

If you are contacting us for the first time, or for the first time in a while, we will need to complete an initial assessment. The initial assessment will help us to decide whether we can help you and how best to do so. This information will be collected by our Reception staff (or a trained volunteer) and /or by an adviser and will later be entered into our computer system by a member of our team. This information will generally include your name, address, date of birth, gender, marital status, employment status, religion, ethnicity, disability, housing tenure and whether you have a long term illness or disability.

The General Data Protection Regulation says we must explain our legal bases for processing this information. We have set this out in our policies and procedures, but in general:

  • Our debt service is funded by the Money and Pensions Service, and we can process personal data using the Public Task legal basis. This is because the Money and Pensions Service has some legal duties around providing debt advice. You can view the Money and Pensions Service’s privacy policy here:

  • We believe that we have a Legitimate Interest in collecting the information listed above. This is because we collect this information to satisfy the conditions attached to our funding and/or we believe we need the information in order to provide our service to you.

  • Some of the information we collect is Special Category Data, as defined by the General Data Protection Regulation (GDPR) – such as race, ethnic origin, religion, health information.

The requirements of the GDPR mean that we may only collect this information under certain conditions. If you are a client of our debt advice service, funded by the Money and Pensions Service, we can process these data for the following reason: “processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes”. For some of our other services, we may ask for your consent to process this data.

More information is available about this via the Information Commissioner’s Office website.

Information you share with us during the course of your case

Throughout the course of conducting your case, we may need to collect further information from you, which we will store in our systems. The type of information we need from you will depend on the issue we are helping you with: for example, if we are helping you with a debt problem, we shall need to record information about your financial situation, such as your income and expenditure and details of your creditors.


What will we do with that information?

We will record your personal data on our Case Management System. This is a cloud-based system which is secure and complies with the requirements of the General Data Protection Regulation. Your data is stored on servers located in the UK and your personal data will only be accessible to CALS staff.

We will use the personal data you provide to work on your case. For example, we will need to keep your contact details so that our advisers can contact you about your case. We may also need your information in order to manage your case effectively: for example, we will need to know about your employment status and your family circumstances so that we can check your entitlement to benefits. We may need to share the personal data you provide with funders so that they can analyse our work and use statistical data to help improve service provision

Some of your information will be stored on our own computer systems. This information is stored in our own servers and our ICT systems are kept up to date and secure by an ICT company we employ.

We may share your information with other organisations such as funders. Please see below for more details.

Who will we share your personal data with?

Organisations relevant to your case

If we’re working on your case, we may need to contact other organisation to help resolve issues, get more information, or share information with them. We’ll ask for your consent before we do this. Some specific examples include:

  • If we are helping you with a debt issue, we may need to contact your creditors in order that we can check how much you owe and negotiate with them on your behalf.

  • We may need to contact the Department for Work and Pensions, for example, if we are dealing with an issue relating to Welfare Benefits.

  • If we are helping you with a housing issue, we might need to contact your landlord or Housing Association.

Our Funders

We rely on funding from various sources to provide our free advice services and are required to share some information with our funders. We will normally ask for your consent in order to share your personal details with a funder, but if you are a client of our debt advice service, we can do this without consent. This data enables us and our funders to understand who is using our services and helps to ensure services are delivered and directed to those in need and where gaps in service delivery are identified; help us to improve our services to meet the needs of clients. However, you can object to us processing your data by asking a member of our team – if you object to us processing your data in a particular way, we will refrain from doing so.

Quality Auditors

We are obliged to have Quality Audits in order to maintain our accreditation to the Lexcel standard and for the benefit of some funders to ensure that the quality of the advice we give meets high standards. These audits are undertaken by external agencies. The processes involve the auditors having to view a selection of case files to check the work that is being done. We will normally ask you to give your consent for your case to be included in the list submitted, from which a random sample is selected. For clients of our debt service, we can submit these files to assessors without consent, but you can object to us sharing your file.

Research and Evaluation

Our funders sometimes engage companies to undertake specific research and evaluation of the work that is done with their funding. This is very important work as it helps us and funders to plan services, develop new ways of working to meet the needs of clients and to look at your experience of getting advice from us and how it has helped you.

We will ask you to participate in this work and we will normally ask you to give your consent for us to share your full details with our funders or organisations appointed by them, so that they can carry out research and evaluation activities. For debt advice clients, where our work is funded by the Money and Pensions Service, we do not need to ask for your consent to be included in research, but we will ask for your permission to be contacted. You can object to us passing on your data for research and you can also change your mind if you have already given permission.

We will still help you, even if you do not give your consent or permission for this work.

Partners who share your data with us

As the Lead Organisation for the East Midlands Money Advice Partnership, which is funded by the Money and Pensions Service, we work with advice agencies across the East Midlands on this project to deliver debt advice service. These partners regularly share some personal data with us about their clients. We use this data to report to the funder. The organisations which share the data with us should have a Privacy Policy similar to this one. While we hold the data, we will keep it securely on our systems. A limited number of our staff members will be able to access this data, and we will share this with the Money and Pensions Service via their secure platform.

Other Data Processors

We may use other organisations to process personal data for us. In line with the terms of the GDPR, we will make sure that we have a contract in place with organisations that processes personal data for us. We will make sure they process your data securely and that they don’t share your data with anyone else.

Transferring Data Outside of the European Economic Area

We do not transfer any data outside of the EEA. If we do need to do this, we will ensure that the appropriate safeguards and permission are in place before we do so.

Selling Your Personal Data

We will not sell your personal data to anyone else.

Automated Decision Making

We do not use any automated decision making tools.


Our website – – uses Google Analytics to help us understand how you use our website. Google Analytics uses Cookies – these are small text files placed on your computer which help websites to understand how you use the site and what your preferences are. You should be able to disable cookies using your internet browser if you prefer to do so. You can find out more about cookies on

If you submit your personal information using the contact form on our website, we will store this information and we may use it to contact you.

Your Rights

The GDPR gives Data Subjects the following rights depending on why we are processing the data. There is more information on your rights on the ICO Website. Below is a short summary of these:

The right to be informed

You have the right to know about how we process your personal data. This Privacy Policy is designed to provide that information.

The right of access

The right to access the personal data we hold about you. You can request this from us and we have to provide it within a month of the request. We cannot charge you for this unless we think the request is unfounded or unreasonable.

The right to rectification

The right to have personal data we hold about you rectified if it is inaccurate.

The right to erasure

The right to have personal data we hold about you deleted.

The right to restrict processing

The right to request that we stop or restrict the processing of your data.

The right to data portability

Depending on why we are processing your data, you may have the right to ask us to make your personal data available to you or to another organisation in a format that means it can be used again.

The right to object

You may be able to object to us processing your data, in which case we may have to cease doing so.

Rights in relation to automated decision making and profiling

You have rights concerning automated decision making and profiling. We do not currently do this.

Withdrawing Consent

If you have given us consent to process your personal data, for example if you have said that we can share your data for research and evaluation, you have the right to withdraw this consent.

In order to withdraw your consent, please contact us using the contact details we have provided above and tell us you no longer want us to use your personal data for these purposes.

How Long Will We Keep Your Data?

We are obliged to keep your personal data and a record of the work we have undertaken for you for six (6) years in order to meet our insurance obligations, since people who have received legal advice from us have 6 years from the date of the closure of their case to make a complaint about the service or to issue a claim.

If your data has been shared with us by a partner organisation in the EMMA project, we will delete the data we hold about you on an annual basis after we have held it for one (1) year. This is to meet the requirements of our funder. The advice agency who saw you will probably keep your data for longer, and they should be able to tell you how long they will hold this for.

Contact Details and Making a Complaint

If you want to talk to someone about what data we hold about you, or if you want us to stop contacting you, please contact us by:

Telephone: 0116 242 1120


In writing or in person: 1st Floor, Epic House, Charles Street, Leicester LE1 3SH

If you wish to make a complaint about how we handle your data, please contact our Executive Director, Kathryn Burgess, using the contact details given above.

If you have contacted us about how we handle your personal data and you are still unhappy, or feel that the issue has not been resolved, you should contact the Information Commissioners Office to raise your concern. Information on how to do this is available via the ICO website – Alternatively you can call the ICO helpline on 0303 123 1113.