Data Protection - Privacy Notice

Data Protection - Privacy Notice

Introduction

The Extra Help Unit (EHU) is run by Citizens Advice Scotland (CAS), a registered Scottish Charity (SC016637).

This Privacy Notice details how we collect and process the personal data of people using our services. It also explains people’s rights and how to contact us.

We will review this notice regularly and will publish any changes on our website.

Please send any questions about how we use personal information, to DPO@cas.org.uk or via post at:

Citizens Advice Scotland

Broadside

2 Powderhall Road

Edinburgh

EH7 4GB

 

About the Extra Help Unit

We help people in vulnerable situations who have an energy or post complaint. This includes people whose energy supply has been disconnected or may soon be disconnected.

We are a statutory service which means we were put in place by law. We help people in England, Scotland and Wales.

 

Information we collect about you

Personal data is information that can identify you. 

We only ask for personal data that is relevant to your case. This might include: 

  • Your contact details such as name, address and phone number
  • Details about your complaint and the support you need
  • Information to help with your complaint, such as meter serial numbers or tenancy documents
  • Information about vulnerabilities that could affect your case, including health conditions, money problems, benefits you get, or children in your home
  • Information your energy supplier shares with us as part of the complaint process
  • If you have agreed to be contacted for feedback
  • If someone is acting on your behalf, we may collect their details too.

 

How we collect your information

We may collect your information:

  • When you contact us by phone, email, letter or through our website
  • From an organisation that referred you, such as the Citizens Advice Consumer Service
  • From your energy supplier as part of the complaint process
  • From someone acting on your behalf.

 

How we use your information

We might use your information to:

  • Explain how we can help
  • Make sure we support those most at risk first
  • Share information with other organisations, such as for referrals
  • Keep records for audit and insurance purposes
  • Improve our service through research
  • Ask for your feedback on our service
  • Report issues to the energy regulator Ofgem (we anonymise your information first).

We use machine learning (a type of technology) to help our work, but we do not make automated decisions about you.

 

Our lawful basis for using your information

We only use your information when we are allowed to, for example:

  • To meet our legal duty to give you advice and support. We use the ‘public task’ lawful basis to record your basic data. If we record special category (sensitive) personal data, we use the ‘substantial public interest’ lawful basis
  • To contact you for feedback, if you have given consent. You can withdraw consent at any time.
  • To defend legal claims and maintain a high quality of our service. We use the ‘legitimate interests’ lawful basis.
  • Where there is a risk to life or significant harm, we may ask for information from your supplier without your consent. We will rely on our ‘public task’ or ‘vital interest’ lawful basis.

 

Who we share your information with

We only share your personal data when necessary and in line with data protection laws.

  • If we refer you to another organisation, we will ask for your permission first
  • To help resolve your case, we might share information with your energy supplier and other organisations such as Citizens Advice, Advice Direct Scotland, Ofgem and the Ombudsman
  • If someone is acting on your behalf, we may share your information with them when necessary
  • If you have a complaint about the EHU, we may share your information with our insurers
  • If we use external service providers, we put in place contracts to ensure they follow data protection rules.

 

Will we share your information outside of the UK?

We only store personal data in the UK or the EU.

However, some of our suppliers may be based in other countries. If we need to share your data with these companies, we take steps to make sure your data is protected.

 

How long we keep your information

We keep your case record for six years after your case is closed. After that, we delete all your personal details. This will be based on your most recent case closed date.

We keep recordings of phone calls for two years.

In rare cases, we might keep your data for longer if there is a legal reason, such as an on-going complaint or legal case.

 

Your Rights

You have rights over your personal data. You can contact our Data Protection Team on DPO@cas.org.uk.

You can:

  • Ask for a copy of your personal information
  • Ask us to fix anything that’s no longer accurate
  • Ask us to delete your personal data. There are some exceptions, and we may need to keep some of your data, for example to defend legal claims
  • Object to how we use data in some situations
  • Ask us to send your information to you or someone else, in some situations
  • Withdraw your consent
  • Ask not to be subject to automated decision-making or profiling.

If you’re unhappy with how we have handled your data, you can complain to the Information Commissioner’s Office at ico.org.uk.

 

Last Updated: June 2025.