Policy | Advicespace

Complaints Policy / Data Protection

Complaints Policy

Complaints Information Guide

The information and service you receive from Advice Space matters a lot. We endeavour to help as much as we can but when our service falls short of what you might have expected it's important that we know about it.

Complaints give us a positive opportunity to improve the way we do things and provide a better service for people.

When things go wrong initially – trying to resolve a difficult situation

Let the adviser know what’s wrong.
Give them an opportunity to put things right and when this can’t be done

Ask for information about next steps

Step 1 - Informal resolution

Our Aim

to get you the advice and information you need and
to resolve your complaint as smoothly as possible.

This could be:

an apology
get an explanation by a senior manager
a referral to another agency

Who will look after this for you:

the person you dealt with
an appropriate member of staff
the most senior local person

Step 2 - Formal stage

This should be used when you indicate that you aren’t satisfied with the stage 1 process.

We will

acknowledge the complaint and
explain how it will be dealt with
investigate what went wrong

We will acknowledge your complaint within 5 working days of receipt and following investigation, provide a full response to the complainant within 8 weeks.

We promise that any investigation will:

Be impartial.
Each complaint will be approached with an open mind
Be confidential.
Be transparent.

Who deals with a formal complaint:

The complaint and the endeavours towards resolution are dealt with by the Service Manager

If you still feel unhappy you can escalate your complaint to be reviewed under the direction of the Director of Advice Space. This is known as stage 3.

Stage three

This process works to:

Ensure the complaints process has been followed
Ensure all issues raised by the complainant have been adequately addressed
Decide if the investigation carried out in a fair and transparent fashion?
Determine if there is a need for continued or additional advice?
Were the conclusions reached previously fair and reasonable and is there sufficient evidence to support them?

We will acknowledge receipt of your request for a review within 5 working days and you will receive our response within 10 working days.

Data Protection Policy

1. Statement of policy

Advice Space is fully committed to compliance with the requirements of the General Data Protection Regulation (GDPR), Data Protection Act 1998 and any successor legislation (together, the ‘data protection legislation’). Advice Space is committed to the policy of protecting the rights and freedoms of individuals with respect to the processing of their personal data and special category personal data.

Advice Space will therefore follow procedures which aim to ensure that all employees and volunteers, and others who have access to any personal data held by or on behalf of Advice Space, are fully aware of and responsible for the handling of personal data in line with the data protection legislation.

In order to operate efficiently, Advice Space needs to collect and use information about people with whom it works. These may include current, past and prospective clients; current, past and prospective employees; current, past and prospective volunteers; and our suppliers.

2. Data Protection Principles

Data protection legislation and in particular Article 5 (1) of the GDPR requires that personal data shall be used in accordance with the following principles:

a) processed lawfully, fairly and in a transparent manner in relation to individuals;

b) collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall not be considered to be incompatible with the initial purposes;

c) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed;

d) accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay;

e) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes subject to implementation of the appropriate technical and organisational measures required by the GDPR in order to safeguard the rights and freedoms of individuals; and

f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.”

Article 5 (2) of the GDPR requires that:

“the controller shall be responsible for, and be able to demonstrate, compliance with the principles.”

3. Lawful bases for processing personal data under the data protection legislation

Advice Space process personal data under the following lawful bases:

(a) Consent: the individual has given clear consent for you to process their personal data for a specific purpose.

(b) Contract: the processing is necessary for a contract you have with the individual, or because they have asked you to take specific steps before entering into a contract.

(c) Legal obligation: the processing is necessary for you to comply with the law (not including contractual obligations).

(d) Legitimate interests: the processing is necessary for your legitimate interests or the legitimate interests of a third party unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests.

Lawful basis for processing special category personal data

Advice Space process special category personal data under the following lawful bases:

Explicit consent: the data subject has given explicit consent to the processing of those personal data for one or more specified purposes.

4. Handling of personal data and special category personal data

Advice Space will, through appropriate management and the use of appropriate controls adhere to the following in regards to our use of personal data and special category personal data;

Provide privacy notices to data subjects.
Collect and process appropriate information and only to the extent that it is needed to fulfil operational needs or to comply with legal requirements.
Ensure the quality and accuracy of information when collected or received and during its use.
Apply checks to determine the length of time information is retained.
Take appropriate technical and organisational security measures based on risks to data subjects.
Not transfer outside the EEA without suitable safeguards.
Ensure that any information incidents are recorded and, where appropriate, reported to the data subject and the Information Commissioners’ Office.
Mitigate risks to the data subjects in the event of an information incident using an appropriate data breach policy.
Ensure that the rights of our data subjects can be properly exercised.

These rights include:

The right to be informed
The right of access
The right to rectification
The right to erase
The right to restrict processing
The right to data portability
The right to object
Rights in relation to automated decision making and profiling.

In addition, we will ensure that:

There is always someone with specific responsibility for data protection in the organisation. Patricia Lyons is currently the Data Protection Officer for the Organisation.
Organisational information and in particular privacy risks are risk assessed, documented and controlled.
Everyone managing and handling personal data and special category personal data understands that they are responsible for complying with the data protection legislation.
Everyone managing and handling personal data and special category personal data is appropriately trained and supervised to do so.
Queries about processing personal data and special category personal data are promptly and courteously dealt withwithin the requirements of the data protection legislation.
Data sharing and processing is carried out under an appropriate written agreement, setting out the scope and limits of the sharing. Any disclosure of personal data will be in compliance with approved procedures.

5. Client management systems

Advice Space will use the case management system Advice Pro and by doing so agrees to adhere to the data sharing agreement between the respective parties.

Data sharing is required so that both the client and Advice Space have flexibility in where, how and when clients receive the service and the need to only enter this client data once. The data protection legislation provides the legal framework under which personal data and special category personal data can be processed.

Data is shared to provide the service to clients, to refer clients to other organisations, for following up with the client for feedback, to enable the Advice Space to act on behalf of the client when authorised, to understand trends and carry out research to enable policy work. The data shared will always be the minimum necessary required to carry out the business purpose.

In all cases the relevant consent must be obtained, or alternative lawful basis determined, for any processing or sharing of client personal data and special category personal data.

Advice Space

Data Controller

Merrion Business Centre

58 Howard Street

Belfast

BT1 6PJ

Privacy Notice

This Privacy Notice outlines how Advice Space collects and uses your personal information.

Advice Space is a charity providing free, independent, confidential and impartial advice. We only ask for the information we need and, depending on why you contact us, we may need to collect different types of information about you.

We protect the privacy and personal data as follows;

we are registered with the Information Commissioner’s Office
the data we hold is processed accordingly with EU General Data Protection Regulation (GDPR)
internally, we hold Data Protection and Data Security Policies which we review regularly as a part of our internal quality assurance

When we hold your personal information, we don’t sell it to anyone and we only share it when you give us a permission, to be able to best assist you.

Advice Space is responsible for keeping your information safe – please look at the table below to see how we keep it safe.

When we outsource services- for example our Case Recording System or Cloud services- we ensure that they are creditable services who will keep your information secure.

If you were a client of Citizens Advice Belfast.

We currently hold information on cases from 2012,securely stored on cloud servers in line with GDPR. These can be accessed by contacting Advice Space on 03001233233.

How we use your information

The main reason we collect your information is to help with your enquiry and represent you in your case. Sometimes, we will need to use it to investigate a complaint, evaluate our service or for training and quality purposes.

How we handle your personal information depends on the reason why you contact us. We will always collect information relevant to what you need from us and to carry out the work of the Organisation. You can always ask us how we use your information.

If you don't want to give us certain information, you don't have to. For example, if you want to stay anonymous, we will only record information about your problem and make sure you're not identified. However- sometimes we can only assist you if you share certain information with us- for example, to complete a form.

We will use the statistical information to help us with lobbying and policy or to demonstrate the work we do. In those cases, we will use anonymised data, meaning that we will not use your personal details, but only describe, for example, type of cases and number of enquiries we got. This is necessary to show the Funders how we assist clients and to continue to receive funding.

Concerns about yours or someone else's safety

If something you've shared with us makes us think you or someone you know might be at serious risk of harm, we could tell the police or social services.

How we use your information from your job and volunteering application

to determine whether you have the right skills for the role
to monitor equality within our workforce and volunteers; this information will always be anonymised

Your rights in relation to information we hold about you

you can access the personal data we hold about you
you can ask us to alter any data that is incorrect, out of date or incomplete
you can ask us to delete your personal data by withdrawing your consent. If you request this, we will explain to you how this impacts the assistance we can provide.

To request a copy of the information we hold on you, please contact patc@advicespace.me

Storing your information

We'll store your information securely on our internal systems using encryptions, login- based access and password protection.

How long do we keep the data?

We only keep your data for as long as is necessary and for the purpose(s) for which you provided it to us. We have a legal obligation to store some types of data for a prescribed length of time- this is called Retention Schedule. When we no longer need the data, we securely dispose of it.

Information Commissioner’s Office

If you believe that your data, or any requests that you made regarding your data, have not been handled correctly, you have the right to complain with the Information Commissioner’s Office.