Privacy Notice for services provided by Active and Creative Communities (PDF)
Who are we?
Active and Creative Communities are a team within North Lanarkshire Council who provide culture and leisure services for North Lanarkshire’s residents and visitors.
Why do we have a Privacy Notice?
North Lanarkshire Council has a legal requirement to let you know how we will manage your personal information. We are aware of the importance of handling your information appropriately and securely. Having this statement helps us to comply with the requirements of the UK GDPR and the Data Protection Act 2018. This statement supplements the council’s privacy notice and should be read in conjunction with it.
What is personal information?
Personal information is any information which identifies someone as a living, private individual or could do so if combined with other information held electronically, e.g. on a computer database or CCTV images.
Why do we need your information and what do we do with it?
We will use your personal information to allow us to carry out the leisure and culture functions that we carry out:
· Sports and leisure activities including gym, swimming and leisure classes and memberships
· Library services including library membership, newsletters, online services and in-person activities
· Macmillan Cancer Support community support services
· Museum and Archives services including activities, workshops, exhibitions and donations
· Venues and events including ticket bookings
· Community Arts classes
· Marketing of any of the above services where we have consent or another legal basis
We will also use your information to comply with our legal obligations, verify your identity where required, contact you by post, email or telephone and to maintain our records.
What types of personal information do we hold?
In order to carry out our business, we collect and use data about our employees, suppliers, service users and customers. We may hold personal information such as a name, address and date of birth and it could be in different formats e.g. photos or video. We could also have sensitive information such as information about health, racial or ethnic origin, or criminal offences.
Legal basis for holding your information:
We will use your personal information using a legal basis from this list:
- Where necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes
- Where necessary for reasons of substantial public interest
- Where necessary to establish, exercise or defend legal claims
- Where necessary to protect the vital interests of you or another person where you or that other person is physically or legally incapable of giving consent
- Where you have given us explicit permission to do so
We may also need to process more sensitive personal information about you. This would include information about race, ethnic origin, politics, religion, trade union membership, genetics, biometrics (where used for ID purposes), health, sex life or sexual orientation. We will process these special categories of sensitive information using a basis from this list:
· Where necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes
· Where necessary for reasons of substantial public interest
· Where necessary to establish, exercise or defend legal claims
· Where necessary to protect the vital interests of you or another person where you or that other person is physically or legally incapable of giving consent
· Where you have given us explicit permission to do so
We may process your personal information using more than one legal basis depending on the specific purpose for which we are using your data
Where we need to collect personal information by law, or under the terms of a contract we have with you and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example to provide you with services). In this case we may have to cancel a service you have with us but we will notify you if this is the case at the time.
We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose.
If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.
Please note we may process your personal information without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.
How long do we keep this information for?
We only keep your personal information for the minimum amount of time necessary. Sometimes this time period is set out in the law, but in most cases it is based on the business need. We maintain a records retention and disposal schedule which sets out how long we hold different types of information for. You can view this on our website at Data protection | North Lanarkshire Council.
How do we collect personal information?
In most cases, the information that we have will come from you directly, e.g. when applying for a library card or buying tickets for an event. However, the information could come from another source such as your legal representative, partner, relatives or other agencies such as North Lanarkshire Council. When we receive personal information about you from another source, we are required to inform you of this within one month of receiving the information.
Who do we share your personal information with?
We are legally obliged to safeguard public funds so we may be required to verify and check your details internally for fraud prevention. We may share this information with other public bodies (and also receive information from these other bodies) for fraud checking purposes. We are also legally obliged to share certain data with other public bodies, such as HMRC and will do so where the law requires this. We will also generally comply with requests for specific information from other regulatory and law enforcement bodies where this is necessary and appropriate. Your information is also analysed internally to help us improve our services.
How do we manage our responsibilities regarding data protection?
Before we start to manage personal information for a new purpose or make significant changes to the way we handle information, we will carry out a Data Protection Impact Assessment at the earliest possible stage in the planning process.
We will ensure that any contractors, who are providing services on our behalf, comply with data protection legislation by asking them to sign a Data processing Agreement.
We will provide you with a Privacy Notice when we collect your information and communicate with you if we are changing our Privacy Statement.
We will ensure that all staff are required to undertake data protection training on a regular basis.
Your rights under data protection law
Please contact us if you wish to exercise any of these rights.
· Access to your information – you have the right to request a copy of the personal information that we hold about you.
· Correcting your information – you may ask us to correct any personal information about you that you believe is not accurate, complete and up to date.
· Deletion of your information – you have the right to ask us to delete personal information about you where:
o you think that we no longer need to hold the information for the purposes for which it was originally obtained
o we are using that information with your consent and you have withdrawn your consent
o you have a genuine objection to our use of your personal information – see Objecting to how we may use your information below
o our use of your personal information is contrary to law or our other legal obligations.
· Objecting to how we may use your information – You have the right at any time to tell us to stop using your personal information for direct marketing purposes.
· Restricting how we may use your information – in some cases, you may ask us to restrict how we use your personal information. This right might apply, for example, where we are checking the accuracy of personal information that we hold about you or we are assessing the objection you have made to our use of your information. This right might also apply if we no longer have a basis for using your personal information but you don’t want us to delete the data. Where this right is realistically applied it will mean that we may only use the relevant personal information with your consent, for legal claims or where there are other public interest grounds to do so.
· Withdrawing consent to use your information – Where we are using your personal information with your consent you may withdraw that consent at any time and we will stop using your personal information for the purpose(s) for which consent was given.
Information you have given us about other people
If you have provided us with anyone else’s details, please make sure that you have told them that you have given their information to us and how they may contact us for further information.
This may be the case for emergency contact information or contact details to take up references in the event of a successful job application. We will only use this information for the purposes for which it has been provided.
How will we tell you if we change our Privacy Notice?
We will change our Data Protection Statement in line with changes to data protection law and will publish any new or amended statement on our websites and through other appropriate channels.
How can you contact our Data Protection Officer?
We have appointed a data protection officer (DPO) who is responsible for overseeing questions in relation to this privacy notice. If you have any questions about this privacy notice, including any requests to exercise your legal rights, please email dataprotection@northlan.gov.uk
Complaints
We aim to directly resolve all complaints about how we handle personal information. However, you also have the right to lodge a complaint with the Information Commissioner’s Office, who can be contacted by post at: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Visit their website for more information at- https://ico.org.uk/concerns