Privacy Policy

1. Introduction

The Data Protection Act 2018 sets out in UK law the legal framework with which local authorities must comply when they process personal data. Providing accessible information to individuals about the use of their personal data is a key element of their legal right to transparency as set out in the UK General Data Protection Regulation 2016 (UK GDPR). Data Controllers and Data Processors are responsible for providing this information and all local authorities are classed as data controllers and may also be data processors in their own right and, as such, they have a duty to inform Councillors, members of the public, agents and staff (known as Data Subjects) on how they process the data that is within their control.

2. Purpose and Scope

The personal information you provide, such as name, address, email address, phone number, organisation will be processed and stored to enable us to contact you and respond to your correspondence, provide information and/or access our facilities and services. The privacy notice is a document that is used to set out the data controller’s policies in simple language how we process the data that is within our control.

3. Definitions

• Data controller – The organisation who (either alone or in common with other data controllers – Joint data controller) determine the purpose for which, and the way data is processed.
• Data Processor – A person or organisation who process data on behalf of and on the orders of a controller
• Data Subject – the person about who you are processing data.
• Data Protection Officer – an officer of the local authority who is responsible for data protection issues within the organisation.
• Personal Data – is classed as any information which on its own or in conjunction with other information available to a Data Controller can identify a Data Subject.
• Special Category data – some Personal Data is classed as being part of a special category, this requires higher levels of protection and additional reasons to process including at times explicit written consent, Article 9 UK GDPR specifically defines ‘special category’ as data relating to:
• Racial or ethnic origin
• Genetics
• Biometrics (where uses for ID purposes)
• Religious or philosophical beliefs
• Trade-union membership
• Health or sex life
• Political opinions
• Process – processed’ or ‘processing’ apply to any activity involving the processing of personal data and is governed by UK GDPR and other legislation such as Human Rights Act this includes but not limited to:
• collecting
• storing
• sharing
• destroying

4. Privacy Notice

This Privacy Notice is provided to you by Boyatt Wood Parish Council (BWPC) who is the data controller. Data Controller contact details – Email: [email protected], Tel: 02382 121529

4.1 The Councils right to process personal data.

General Data Protection Regulations 2016 Article 6 Processing is with consent of the data subject or Processing is necessary for compliance with a legal obligation or Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

4.2 The Council will comply with legislation.

Article 5 of the UK GDPR sets out seven key principles which lie at the heart of the general data protection regime. Personal data held must be:
• Used lawfully, fairly and in a transparent way.
• Collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes.
• Relevant to the purposes we have told you about and limited only to those purposes.
• Accurate and kept up to date.
• Kept only as long as necessary.
• Processed in a manner that ensures appropriate security to protect personal data from loss, misuse, unauthorised access and disclosure.
• The Data controller responsibility who is accountable for the processing of data

4.3 Who the council works together with:

• Other data controllers, such as local authorities, public authorities, central government and agencies such as HMRC and DVLA
• Staff pension providers
• Former and prospective employers
• DBS service suppliers
• Payroll service providers
• Recruitment agencies
• Credit reference agencies
• Contractors, other agents
• Volunteers, Community Groups, not for profit entities

4.4 Data we collect and process:

The personal information we process is provided to us directly or indirectly by you for one of the following reasons:
• Correspondence, enquiries
• Recruitment/Employment
• Contractors/Agents
• Use of Council services
• Suppliers/Customers
• Community projects

The data we collect may include information/identifiers such as:
• Names, titles, aliases and photographs.
• Contact details such as name, telephone numbers, addresses, and email addresses.
• Gender, age, date of birth, marital status, nationality, work history, academic/professional qualifications, employment and recruitment records, hobbies, family composition, dependants and emergency contact details
• Non-financial identifiers such as passport numbers, driving licence numbers, vehicle registration numbers, taxpayer identification numbers, staff identification numbers, tax reference codes, and national insurance numbers.
• Financial identifiers such as bank account numbers, payment card numbers, payment/transaction identifiers, policy numbers, and claim numbers.
• Financial information such as National Insurance number, pay and pay records, tax code, tax and benefits contributions, expenses claimed.
• Other operational personal data created, obtained, or otherwise processed in the course of carrying out our activities, including but not limited to, CCTV footage, recordings of telephone conversations, IP addresses and website visit histories, logs of visitors, and logs of accidents, injuries and insurance claims.

4.5 Children

BWPC will not process any data relating to a child (under 16) without the express parental/ guardian consent of the child concerned.

4.6 How we use the information provided.

BWPC will only share information held to third parties where necessary and uses the information provided to fulfil its obligations to the community, discharge its functions as a council, and/or fulfil its legal obligations, this includes;
• Administering the recruitment, employment and termination of council staff.
• Conducting grievance or disciplinary proceedings.
• Planning for the termination of our working relationship.
• Education, training and development requirements.
• Dealing with legal disputes involving you, including accidents at work.
• Complying with health and safety obligations.
• To maintain our own accounts, records and prevent fraud.
• To monitor your use of our information and communication systems to ensure compliance with our IT policies.
• To ensure network and information security, including preventing unauthorised access to our computer and electronic communications systems and preventing malicious software distribution.
• Equal opportunities monitoring.
• To undertake activity consistent with our statutory functions and powers including any delegated functions.
• To seek your views or comments.
• To administer Councils interests
• To provide a reference. On rare occasions we may be required to share data
• Where we need to protect your interests (or someone else’s interests).
• Where it is needed in the public interest [or for official purposes]. We do not use profiling tools, we do not sell or pass your data to third parties for profit. We do not use your data for purposes other than those specified.

4.7 Storage of information

Your information is stored securely, the Data Controller is responsible for ensuring systems are in place to ensure the security of the information held from unauthorised access and disclosure, destruction and manipulation. Legally BWPC as a public authority is required to keep certain records forever. Other records are only required to be retained for a certain period for example financial records. Periodically all records held by the council will be reviewed and a decision made to retain or destroy the records. In general, we will endeavour to keep data only for as long as is necessary. This means that we will securely dispose of the information when it is no longer required.

4.8 Change of use

If we wish to use your personal data for a new purpose, not covered by this Privacy Notice, then we will provide you with a new notice explaining this new use prior to commencing the processing and setting out the relevant purposes and processing conditions. Where and whenever necessary, we will seek your consent prior to the new processing.

4.9 Your responsibilities

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your working relationship with us.

4.10 Your data protection rights.

When exercising any of the rights listed below, we may need to verify your identity for security purposes. In such cases we will need you to respond with proof of your identity prior to us processing your request. You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you. BWPC will advise you of the outcome of your request and if we were legally able to process your request. Additional requests for the same personal data may be subject to an administrative fee. You have the following rights with respect to personal data:
-i) Your right of access You have the right to ask us for copies of your personal information. How we obtained the information and why we hold it.
ii) Your right to rectification You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
iii) Your right to erasure You have the right to ask us to erase your personal information in certain circumstances. If we are unable to delete due to legal obligations, you will be informed.
iv) Your right to restriction of processing You have the right to ask us to restrict the processing of your personal information in certain circumstances.
v) Your right to object to processing You have the the right to object to the processing of your personal information in certain circumstances.
vi) Your right to data portability You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.

4.11 How to make a complaint.

If you have any concerns about our use of your personal information, you can make a complaint to us at: [email protected], Tel: 02382 121529 If you are dissatisfied with our process, you can also complain to the Information Commissioners Office Information Commissioner’s Office Wycliffe House Water Lane Wilmslow Cheshire SK9 5AF Helpline number: 0303 123 1113 ICO website: https://www.ico.org.uk

5. Cookies

Category	Cookie Name	Purpose
Google	NID,1P_JAR,GCIC,CONSENT,ANID,__Secure-3PAPISID,__Secure-3PSID,__Secure-3PSIDCC	Used by Google to deliver Google Maps and Captcha services on the website
Necessary Cookies	cookiesAcceptedGoogle	Necessary cookies enable core functionality. The website cannot function properly without these cookies, and can only be disabled by changing your browser preferences.
Necessary Cookies	PHPSESSID	Necessary cookies enable core functionality. The website cannot function properly without these cookies, and can only be disabled by changing your browser preferences.
Necessary Cookies	aubergine_cookie_consent	Necessary cookies enable core functionality. The website cannot function properly without these cookies, and can only be disabled by changing your browser preferences.
Necessary Cookies	close_site_notice	Necessary cookies enable core functionality. The website cannot function properly without these cookies, and can only be disabled by changing your browser preferences.
Necessary Cookies	_GRECAPTCHA	Necessary cookies enable core functionality. The website cannot function properly without these cookies, and can only be disabled by changing your browser preferences.