Privacy Notice


Who We Are

The Centre for Building Social Action Limited (CBSA) gather and process your personal information in accordance with this privacy notice and in compliance with the relevant data protection regulation and laws. This notice provides you with the necessary information regarding your rights and our obligations, and explains how, why and when we process your personal data.

It is important that you read this Privacy Notice together with any other Privacy Notice or Fair Processing Notice we may provide on specific occasions when we are collecting or processing personal data about you so that you are totally aware of how and why we are using your data.  This Privacy Notice supplements the other notices and is not intended to override them

CBSA’s registered office is at The Stebonheath Centre, Stebonheath Terrace, Llanelli, SA15 1NE and we are a company registered in England and Wales under company number 02633128.   We are registered on the Information Commissioner's Office Register; registration number Z1718197, and for the purposes of data protection legislation, we are the data controller when processing your data.

If you have any comments, questions or requests regarding this privacy policy please address to our appointed person, Gerald Davies, CBSA Limited, Stebonheath Centre, Stebonheath Terrace, Llanelli, SA15 1NE or email


Information That We Collect

CBSA processes your personal information to meet our legal, statutory and contractual obligations and to provide you with our products and services. We will never collect any unnecessary personal data from you and do not process your information in any way, other than as specified in this notice.


The personal data that we collect is-

Date of Birth
Home Address
Personal Email
Business Email
Levels of education
Home Telephone Number
Mobile Telephone Number
National Insurance Number
Passport Number
Driver’s License Number
Health/medical information
Details about religion, sexuality, ethnicity etc
Criminal Convictions


It applies to information we collect about:

Visitors to our website
Job applicants and our current and former employees
Service users e.g. who take part in our projects
Volunteers who help us deliver our services
Individuals who subscribe to our newsletters or request for information from CBSA
Tenants who rent our business units


How We Use Your Personal Data

CBSA takes your privacy very seriously and will never disclose, share or sell your data without your consent; unless required to do so by law. We only retain your data for as long as is necessary and for the purpose(s) specified in this notice. Where you have consented to us providing you with marketing information, you are free to withdraw this consent at any time.  The purposes and reasons for processing your personal data are detailed below: -


Visitors to our websites:

When someone visits we use a third party service, Google Analytics, to collect standard internet log information and details of visitor behaviour patterns.  We do this to find out things such as the number of visitors to the various parts of the site.  The information is only processed in a way which does not identify anyone.  We do not make, and do not allow Google to make, any attempt to find out the identities of those visiting our website.  If we do want to collect personally identifiable information through our website, we will be up front about this.  We will make it clear when we collect personal information and will explain what we intend to do with it. 



We use a third party provider, Mail Chimp, to delivery our e-newsletters.   We gather statistics around email opening and clicks using industry standard technology including clear gifs to help us monitor an improve our e-newsletter.


People who contact us through social media

We use a third party provider, Hootsuite to manage our social media interactions.  If you send us a private or direct message via social media the message will be stored by Hootsuite for 3 months.  It will not be shared with any other organisation


People who email us.

If you send us an email it will be stored for 12 months unless it is directly related to a contract whereby we will store as per our funders instructions.  It will not be shared with another organisation unless we have your express consent.  


People who make a complaint to us

When we receive a complaint from a person we make up a file containing details of the complaint.  This normally contains the identity of the complainant and any other individual involved in the complaint.  We will only use the personal information we collect to process the complaint and to check on the level of service we provide.   We usually have to disclose the complainant’s identity to whoever the complaint is about.  This is to a degree, inevitable, but if a complainant doesn’t want information identifying him or her to be disclosed, we will try to respect that.  However, it may not be possible to handle a complaint on an anonymous basis. 


We will keep personal information contained in complaint files in line with our retention policy.  This means that information relating to a complaint will be retained for two years from closure.  It will be retained in a secure environment and access to it will be restricted according to a ‘need to know’ principle.


People who access our services (service users)

CBSA offers a variety of services to individuals in order to deliver our overarching mission.   Data is gathered from potential service users to ensure that they are eligible for our services and to allow us to ensure we are providing our beneficiaries with the most appropriate support and service.

As we work with a range of service users we have developed bespoke privacy notices for each category and this documentation will be made available to you prior to accessing our services.   We ask for your specific consent in writing prior to any data processing.


Job applicants and current and former employees

If you apply to work at CBSA, we will only use the information you give us to process your application and to monitor recruitment statistics. If we want to disclose information to someone outside CBSA- for example, if we need a reference, or need to get a ‘disclosure’ from the Criminal Records Bureau - we will make sure we tell you beforehand, unless we are required to disclose this information by law.

If you are unsuccessful in your job application; we will hold your personal information for 6 months after we’ve finished recruiting the post you applied for.  After this date we will destroy or delete your information. If you begin employment with us, we will put together a file about your employment. We keep the information in this file secure, and will only use it for matters that apply directly to your employment.

Once you stop working for us, we will keep this file according to our record retention guidelines. You can contact us to find out more about this. If you apply for a job or volunteering opportunity, we will also collect information so we can assess your suitability for the role

Your Rights

You have the right to access any personal information that CBSA Limited processes about you and to request information about: -

What personal data we hold about you
The purposes of the processing
The categories of personal data concerned
The recipients to whom the personal data has/will be disclosed
How long we intend to store your personal data for
If we did not collect the data directly from you, information about the source


If you believe that we hold any incomplete or inaccurate data about you, you have the right to ask us to correct and/or complete the information and we will strive to do so as quickly as possible; unless there is a valid reason for not doing so, at which point you will be notified.

You also have the right to request erasure of your personal data or to restrict processing (where applicable) in accordance with the data protection laws; as well as to object to any direct marketing from us. Where applicable, you have the right to data portability of your information and the right to be informed about any automated decision-making we may use.

We do not at the current time utilize any automated decision making function. If we receive a request from you to exercise any of the above rights, we may ask you to verify your identity before acting on the request; this is to ensure that your data is protected and kept secure.


Sharing and Disclosing Your Personal Information

Data processors are third parties who provide services for us. We have contracts in place with our data processors. This means that they cannot do anything with your personal information unless we have instructed them to do it. They will not share your personal information with any organisation apart from us. They will hold it securely and retain it for the period we instruct required by law.

We do not share or disclose any of your personal information without your consent, other than for the purposes specified in this notice or where there is a legal or contractual requirement.  CBSA uses data processors to provide the below services and business functions; however, all processors acting on our behalf only process your data in accordance with instructions from us and comply fully with this privacy notice, the data protection laws and any other appropriate confidentiality and security measures.


Charles and Co

We use Charles and Co Ltd provide our payroll services thus acting in the capacity of a processor on our behalf.   We provide them with your name, bank details, address, date of birth, national insurance number and salary.

For more information about Charles and Co, please read their Privacy Notice at


Likewise, your details will be provided to AGON who are the administrators of our pension scheme.  Employees will be auto-enrolled into the pension scheme and provided with your name, address, date of birth, National Insurance Number and salary.   

For more information on AEGON, please read their privacy notice at

Shred IT Services

We use Shred IT to destroy all our data.   As such they have access to a variety of personal data which they securely destroy on site.   However, it is sometimes necessary due to bulk for them to remove documents off site for secure destruction.

For more information about Shred It, please read their privacy notice at

Big Cloud IT

We use BIG Cloud for all our ICT functions and they act in the capacity of a processor on our behalf.  They have access to our ICT systems in order to meet our business, contractual and legal requirements.  As such they have access to a variety of personal data. 

For more information about BIG CloudIT, please read their privacy notice at


We are a registered Centre for AGORED and they act in the capacity of a processor on our behalf when we register learner data.   We provide them with the following data, name, date of birth, postcode, economic status, and ethnicity.  For more information on AGROED please read their privacy notice.


Safeguarding Measures

CBSA takes your privacy seriously and takes every reasonable measure and precaution to protect and secure your personal data. We work hard to protect you and your information from unauthorised access, alteration, disclosure or destruction and have several layers of security measures in place, including: -


Encryptions and complex password system
restricted access
IT authentication
Firewalls; and
anti-virus/malware software


Transfers Outside the EU

Personal data in the European Union is protected by the General Data Protection Regulation (GDPR) but some other countries may not necessarily have the same high standard of protection for your personal data. CBSA Limited does not transfer or store any personal data outside the EU.


Consequences of Not Providing Your Data

CBSA Limited deliver a range of services which are funded public finances.   You are not obligated to provide your personal information to us however, as this information is required for us to provide you with our services, we will not be able to offer some/all our services without it.


How Long We Keep Your Data

CBSA only ever retains personal information for as long as is necessary and we have strict review and retention policies in place to meet these obligations. We are required under UK tax law to keep your basic personal data (name, address, contact details) for a minimum of 6 years after which time it will be destroyed.

Additionally, we are required by our various funders to retain information for various periods ranging from 7 years to 25 years.

Where you have consented to us using your details for direct marketing, we will keep such data until you notify us otherwise and/or withdraw your consent.


Special Categories Data

Owing to the services that we offer, CBSA needs to process sensitive personal information (known as special category data) about you, this information is to enable us to determine your eligibility to register with our projects and then to enable us to tailor our services to best meet your specific needs. Where we collect such information, we will only request and process the minimum necessary for the specified purpose and identify a compliant legal basis for doing so.   Where we rely on your consent for processing special category data, we will obtain your explicit consent through a signature.   You can modify or withdraw consent at any time, which we will act on immediately, unless there is a legitimate or legal reason for not doing so.

Lodging A Complaint

CBSA Limited only processes your personal information in compliance with this privacy notice and in accordance with the relevant data protection laws. If, however you wish to raise a complaint regarding the processing of your personal data or are unsatisfied with how we have handled your information, you have the right to lodge a complaint either with ourselves or with the supervisory authority.


The ICO contact information is:

Information Commissioner’s Office
Wycliffe House
Water Lane
Telephone: 0303 123 1113 (local rate) or 01625 545 745 (national rate)
Fax: 01625 524 510


This privacy notice was updated on the 25th May 2018