We ask that you read this privacy policy carefully as it contains important information on who we are, how and why we collect, store, use and share personal information, your rights in relation to your personal information and on how to contact us and the relevant supervisory authority in the event you have a complaint

1.     Who we are and how to contact us

Our website, emails originating at the brixtonadvice.org.uk domain, and our online forms is operated by Brixton Advice Centre. We are a non-profit advice centre and charity and as well as face-to-face and telephone services we operate an online legal clinic for those who cannot otherwise afford legal advice. In this capacity we collect, use and are responsible for certain personal information about you. This information is stored securely in our Case Management system

When we process your personal information, we are regulated under the General Data Protection Regulation (“GDPR”) which applies across the European Union and the United Kingdom, and the Data Protection Act 2018, and we are responsible as ‘controller’ of that personal information for the purposes of those laws

Our postal address is 167 Railton Road, London SE24 0LU, and you can get in contact with us by writing to us at this address or through our designated data protection contact form which you can find here: link. All enquires made through this form will automatically be received by the person at Brixton Advice Centre with overall responsibility for data protection, Patrick Torsney, who is also Brixton Advice Centre’s Chief Executive

2.     Our website

This privacy policy relates to your use of our website, https://brixtonadvice.org.uk/ and not to any other website

Our website contains a link to our funding page on Charities Aid Foundation (“CAF”): https://cafdonate.cafonline.org/13479#!/DonationDetails

CAF may gather information about you in accordance with its own separate privacy policies. For privacy information relating to their website, please consult their privacy policies as appropriate

Our website contains numerous links to other websites where you may be able to obtain assistance depending on your area of enquiry. We are not responsible for the content of those sites and encourage you to check the respective privacy policies of those sites

3.     Our collection of your personal information

We collect personal information about you when you approach us requesting assistance with a query. This may be when you use our legal clinic enquiry form, our contact form, our complaints and feedback form, our staff and volunteer recruitment forms including diversity forms, and our form for submitting queries relating to data protection (“the Forms”). In addition, we similarly collect personal information about you when you approach us in-person at our main office and at outreach sessions and when responding to telephone enquiries. We collect this personal information from you directly as opposed to indirectly through third parties or cookies. Our website is not intended for use by children and we do not knowingly collect or use personal information relating to children

Specifically, we collect your name, email address and telephone number if you use the Forms

If you use the Online Legal Clinic enquiry form, our Advice Forms, or our diversity monitoring form that is part of our recruitment form, we may additionally collect personal information on any special needs or disabilities you have as well as your gender and your ethnic background. Providing this information is entirely voluntary – you may choose not to provide us with this information, and we will obtain your consent prior to you submitting the form for the processing of this and any other special category data. The same applies if you approach us in person or by telephone and your details are entered onto one of our forms or onto our case management system directly in the course of responding to your query

Whether we collect any further personal information from you depends on what you write in the box provided in the Forms or your response to any question put to you

4.     Our use of your personal information

We use this personal information to verify your identify, to ascertain the nature of your legal issue, to be able to contact you about and provide you with advice on your legal issue, to improve our service (if you chose to give us feedback via one of the forms), to comply with our Legal Aid Agency contract and for funder (see below) and regulatory purposes

We also use the data to produce anonymous statistics on the various demographics of people accessing our services e.g. what proportion of clients are disabled or are of a particular age group. This type of report is a general funder requirement – all funders want to know that their funding is being used for the purposes it was intended so will invariably ask for some form of statistical monitoring report. We also do this to be able to determine trends with a view to identifying new advice services we might need to provide. None of these reports ever identify individuals or contain sufficiently granular information by which it would be possible to identify any particular individual

We store your personal information for twelve months. Any personal information you provide to us in the context of obtaining legal advice will be stored for 6 years or 12 years in exceptional cases for regulatory purposes. Data provided through our recruitment forms, including diversity forms, is retained for twelve months unless you are subsequently taken on by the Centre in which case it is held for twelve months after your departure if you were a volunteer or permanently if you were a paid member of staff subject to your rights below at (8)

5.     Our legal basis for processing your personal information

When we use your personal information we are required to have a legal basis for doing so. There are various different legal bases on which we may rely, depending on what personal information we process and why

The legal bases we may rely on include:

• consent: where you have given us clear consent for us to process your personal information for a specific purpose
• legal obligation: where our use of your personal information is necessary for us to comply with the law (not including contractual obligations)
• legitimate interests: where our use of your personal information is necessary for our legitimate interests (unless there is a good reason to protect your personal information which overrides our legitimate interests)

6.     Who we share your personal information with

We will share personal information with law enforcement or other authorities only if required by applicable law to do so

We will not share your personal information with any other third party, neither within the EEA, nor outside it. We may sometimes use your data to prepare anonymised statistics to share these statistics with funders (see 4 above) and for us to see if we are reaching everyone in our community. These statistics are anonymised and you are not able to be identified from them

7.     Cookies and other tracking technologies

We do not use cookies or other tracking devices on our website that would allow us to build up a picture of individual users

8.     Your rights

Under the GDPR you have a number of important rights free of charge. Specifically, you have the following rights:

(a) Right to be informed: you have the right to be informed about the collection and use of your personal data. Click this link for more information: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/the-right-to-be-informed/

(b) Right of access: You have the right to ask us whether we are using or storing your personal information. You can also ask us for copies of your personal information, verbally or in writing. his right always applies. There are some exemptions, which means you may not always receive all the information we process. Click here for further information: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-of-access/

(c) Right to rectification: You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete. This right always applies

(d) Right to erasure: You have the right to ask us to erase your personal information in certain circumstances. Click here for further information: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-to-erasure/

(e) Right to restrict processing: You have the right to ask us to restrict the processing of your information in certain circumstances. Click here for further information: https://ico.org.uk/your-data-matters/your-right-to-limit-how-organisations-use-your-data/

(f) Right to data portability: This only applies to information you have given us. You have the right to ask that we transfer the information you gave us from one organisation to another, or give it to you. The right only applies if we are processing information based on your consent or under, or in talks about entering into a contract and the processing is automated

(g) Right to object: UK GDPR gives individuals the right to object to the processing of their personal data in certain circumstances, such as for marketing purposes. You can find more information about this particular right by clicking here: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-to-object/

(h) Rights related to automated decision-making: you have rights in respect of automated individual decision-making (making a decision solely by automated means without any human involvement), and profiling (automated processing of personal data to evaluate certain things about an individual) whether or not the profiling is part of an automated decision-making process. We do not we undertake any automatic decision-making or automated processing of personal data. You can find out more about this particular right by clicking here: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/rights-related-to-automated-decision-making-including-profiling/

For further information on each of those rights, including the circumstances in which they apply, see the Guidance from the UK Information Commissioner’s Office (ICO) on individuals rights under the General Data Protection Regulation

If you would like to exercise any of those rights, please contact us to the form mentioned in Section 1 (“Who we are & how to contact us”) above

9.     Keeping your personal information secure

We have appropriate security measures in place to prevent personal information from being accidentally lost, or used or accessed in an unauthorised way

We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so

10.  How to complain

We hope that our nominated person responsible for data protection can resolve any query or concern you raise about our use of your information. Please see Section 1 (“Who we are and how to contact us”) above for further information.

The GDPR also gives you the right to lodge a complaint with a supervisory authority, in particular in a European Economic Area state or in the United Kingdom if you work, normally live or if any alleged infringement of data protection laws occurred in the relevant state. The supervisory authority in the UK is the Information Commissioner who may be contacted at https://ico.org.uk/global/contact-us/ or via telephone: 0303 123 1113

11.  Changes to this privacy policy

This privacy policy was published on 31 July 2020 and was last updated on:

• 18 January 2023 [additional textual explanation of Rights (g) and (h) above including addition of links
• 13 March 2023 [broadened scope of wording so it is clear that this Policy includes, for example, forms being completed via face-to-face or telephone whereby an adviser would complete the form on behalf of the person presenting their query]
• 8 August 2023 [re-ordered rights in Section 8 – right to object had been included twice]

We may change this Privacy Policy from time to time and you are expected to come back to this page periodically to check for any updates. Any material updates will be listed here in this Section 11

12.  Do you need extra help?

If you would like this website privacy policy in another format (for example: audio, large print), please contact us through the Form in Section 1 (“Who we are & how to contact us”) above