Privacy Policy

CHAP respects your personal information and undertakes to comply with the General Data Protection Regulation 2018 and Data Protection Act 2018, which changes how personal sensitive data is handled.

The live chat functionality uses a secure server and is fully GDPR compliant.

Client information that is held by CHAP

In order to assist individuals with housing/welfare rights/debt issues, personal data that may have to be collected and recorded following an initial online enquiry will include all or some of the following, depending on what service/level of assistance is required:

• Name, address, postcode and telephone number 
• E-mail address –
• National Insurance number
• Marital status 
• Household composition 
• Name and date of birth of others residing in property 
• Details of partner, if applicable 
• How referred to service and how heard about service
• Expenditure details, if relevant
• Current employment status/details
• Prison background, if relevant
• Disability and health issues
• If a bank account or post office account is held
• Details of debt/creditors, if relevant to situation
• Previous tenancies held 
• Circumstances which require support and background to the issue at hand
• Details of previous issues which may impact on situation (eviction, debt etc…)
• Date of birth
• Place of birth
• Gender
• Any military connections
• Housing situation
• Welfare benefits situation
• Any caring responsibilities
• Income details
• Any other agencies involved
• If savings are held
• If high interest credit is used
• Ethnicity
• Any social services involvement
• If home contents insurance is held
• Next of Kin (DIGS only)

Your personal information will be collected from you or from third parties that you have given CHAP permission to contact in regards to your situation.

What your information will be used for

CHAP’s lawful basis for processing your information is ‘Legitimate Interests’, which are detailed below.

The data will be used to provide you with advice and support and will also be used for the following purposes:

• To allow funders to monitor the success and performance of services offered
• To contact you for feedback regarding the quality of services provided to you
• To monitor compliance with equal opportunities legislation

Who your information may be shared with

• Your information may be shared with other organisations only following your consent to make a referral to them.  If it is thought that a referral to another organisation may assist with your situation, this will be discussed with you and explicit consent received from you verbally in order to progress with the referral
• Funders of CHAP services including North Ayrshire Council, East Ayrshire Council, Nationwide, Scottish Government and Scottish Legal Aid Board for quality assurance/audit purposes

How your information is transferred

Information will normally be exchanged electronically between CHAP and the relevant organisation, in a secure format.

How your information is stored

• Your information is stored in a locked filing cabinet and only those authorised to see this information in the course of their duties will have access to this cabinet.  You are allocated a unique client file number which is used to protect your identity
• Your information is also stored on a database which only those authorised to see this information in the course of their duties have access to and as a further security measure, the database is password protected

How long your information is stored for

We store your information for 5 years in order to:

• Provide information to funders, where requested
• Be able to assist you if you return to CHAP for assistance in the future

What your rights are in terms of your personal information

• You have the right to access your personal data by making a ‘subject access request’ at any time to check the data we hold and what we do with it. You also have further rights which are clearly laid out in data protection law. Further information, if required, can be found in our ‘Data Subject Rights Procedure’ below.
• You have the right to complain to the Information Commissioners Office if you think there is a problem with the way we are handling your personal data. Their website address is www.ico.org.uk and the phone number is 0303 123 1113
  

Data Subject Rights Procedure

CHAP has processes in place to ensure that it can facilitate any request made by an individual to exercise their rights under Data Protection Law. All staff have received training and are aware of the rights of the data subjects. Staff can identify such a request and know who to send it to.

In many cases, a request for information or routine enquiry can be dealt with in the normal course of our work. Examples are:

“When did CHAP send a letter to me?”

“I have lost the previous letter you sent me, can you resend it?”

These can be dealt with informally and there is no need to implement this procedure.

It is likely that requests such as the ones detailed below would require to be dealt with under this procedure.

“I have a right to see all the information held about me. Please send a copy to me”

“I am a solicitor acting on behalf of my client and request a copy of their records. An appropriate authority is enclosed”

Rights of individuals under Data Protection Law

Subject Access

The right to request information about how personal data is being processed, including whether personal data is being processed and the right to be allowed access to that data and to be provided with a copy of that data along with the right to obtain the following information:

• The purpose of the processing
• The categories of personal data
• The recipients to whom data has been disclosed or which will be disclosed
• The retention period
• The right to lodge a complaint with the Information Commissioner’s Office
• The source of the information if not collected direct from the subject

Rectification

The right to allow a data subject (the individual to whom information relates to) to request that inaccurate personal data concerning them is rectified. If the data has been passed to a third party, CHAP will contact them regarding the inaccuracy if the right to rectification is granted.

Erasure

The right to have personal data erased and to have confirmation of erasure but only where:

• The data is no longer necessary in relation to the purpose for which it was collected, or
• Where consent is withdrawn, or
• Where there is no legal basis for the processing, or
• There is a legal obligation to delete data

Restriction of Processing

The right to ask for certain processing to be restricted in the following circumstances:

• If the accuracy of the personal data is being contested, or
• If our processing is unlawful but the data subject does not want it erased, or
• If the data is no longer needed for the purpose of the processing but it is required by the data subject for the establishment, exercise or defence of legal claims, or
• If the data subject has objected to the processing, pending verification of that objection

Object to Processing

The right to object to the processing of personal data relying on the legitimate interests processing condition, unless CHAP can demonstrate compelling legitimate grounds for the processing which override the interests of the data subject or for the establishment, exercise or defence of legal claims.

Enforcing Rights

If an individual wishes to enforce any of the above rights, they can do so at any time. All such requests will be dealt with by Senior Management at CHAP and will be considered without undue delay and within one month of receipt as far is possible.  Where requests are complex, organisations are permitted to extend the deadline to three months. However, CHAP would still respond to the request within one month to explain why the extension is necessary.

Data subjects can make such requests verbally, in person or via e-mail/letter.  Individuals will be asked some security questions by Senior Management before their request is considered in order to verify identification.  If a third party is requesting the information, we will ask them to provide evidence of their authorisation to act on behalf of an individual.

If a subject access request is refused, individuals will be given the reason for this and advised that they have the right to complain to the Information Commissioner’s Office



No fee will be charged for any such requests.