Privacy Policy
EAST RENFREWSHIRE CULTURE AND LEISURE’S DATA PROTECTION AND PRIVACY POLICY
This is our full privacy notice. It describes the categories of personal data (information about living identifiable individuals) that we process and for what purposes. We take our data protection responsibilities very seriously and will always ensure that collecting and using such data is in accordance with data protection laws.
East Renfrewshire Culture and Leisure operate a number of different services and each service will have a specific privacy policy which complements this full privacy notice. These can be viewed as downloads by clicking on the relevant link on this page or by asking to see a physical copy in any of our venues.
For more information in relation to our approach to data protection, including how we seek to ensure that we comply with our obligations under data protection laws including governance arrangements and how long we will hold your personal information, please see our individual privacy notices and our Data Protection Policy. You can request a copy of the Policy from our Data Protection Officer, whose contact details are given in the section headed “Useful Information” in this notice.
THE KINDS OF PERSONAL INFORMATION WE USE
We use a variety of personal information about people depending upon the purpose behind the use. The minimum will be your name and address. However, we may also ask for information to prove your identity or to ensure that you are entitled to or qualified for services that we provide. This could include other information such as your date of birth, your family details, services being provided to you, your financial details and your interactions with us.
There are times where we collect personal data that warrant special protection. This could be information about your physical or mental health details, racial or ethnic origin (in connection with our duties in relation to equality monitoring), religion or other beliefs (again in relation to equalities monitoring but also if you complete one of our surveys). However, we will strictly control the use of such personal information and will only use it in connection with specific services unless we tell you otherwise.
Sometimes, we will be collecting your personal information because we need to do so to enter into a contract with you. There is more explanation about these situations in the section headed “How we use your personal information“. In those cases, if you fail to provide the information, we will not be able to provide you with services where there are contractual obligations on you such as payment or other conditions.
HOW WE GATHER YOUR PERSONAL INFORMATION
We obtain personal information about people
- directly from you, for example when you fill out an application form
- from other people who are connected with you in connection with a service to be or being provided to them
- from people who are complaining regarding your actions and compliance with the law and
- other public bodies such as other Councils, Police Scotland, Audit Scotland and regulators such as the Scottish Social Services Council or the General Teaching Council.
We may also collect some personal information from using CCTV. We use CCTV to deter and detect antisocial behaviour, the protection of our buildings and for the protection of our employees and other people.
HOW WE USE YOUR PERSONAL INFORMATION
We will have told you, at the point of collection of your personal information from you, the purposes for which we will use it. However, in general terms, we use personal information where
- it is necessary to do so to provide a statutory function or service including one to which you are entitled. Failure to provide any needed information will mean that we will not be able to provide you with that service
- to provide a statutory service to you, we wish to impose contractual obligations on you in relation to that service (a contract)
- It is necessary to do so in order to comply with a legal obligation (this could include providing information to Police Scotland or other third parties as a result of a court order)
- It is necessary to do so for the legitimate interests of the organisation but only where those interests outweigh your own personal rights and freedoms or
- You consent to us doing so. This could be where what we are doing is to facilitate or be conducive to a statutory function but this is not a necessary part of a statutory function.
If we are using your personal data that requires special protection, we will only do so where one of the above situations applies and we can meet any further justification required by data protection law. These conditions could include
- it is necessary to do so to provide a statutory function or service being carried out in the public interest including one to which you are entitled
- it is necessary for the monitoring of our compliance with equality laws
- it is necessary for the provision of confidential counselling, advice or support or of another similar service provided confidentially being carried out in the public interest
- it is necessary in order to respond to enquiries from elected representatives
- it is necessary to do so in order to provide health and social care services and management such systems or
- you have given explicit consent to us using your protected personal data
Where the law requires us to have an appropriate policy in place, this is our Data Protection Policy. You can request a copy of the Policy from our Data Protection Officer, whose contact details are given in the section headed “Useful Information” in this notice.
If you have given us your consent to process your personal information, you can withdraw that consent at any time by contacting the methods that we told you about when you when you first gave consent. Alternatively, you can contact our Data Protection Officer (DPO). Details of the DPO are available under Useful Informationat the end of this notice.
SHARING YOUR PERSONAL INFORMATION
If we obtained your personal information from you, we should have told you at the point of collection with whom we will share that particular information and in relation to which scenario set out in the section headed “How we use your personal information“. You will find this in the relevant privacy notice which you can access by following the links on this page.
TRANSFERS OUTSIDE THE UK
We do not as a rule share personal information outside the UK. However, there may be times where we use a processor (someone who holds or uses the personal information on our behalf and under our instructions).
The processor or the location that the personal information will be held etc, is outside the EU, we will only use that processor if
- it or the location of the information will be in a country which the EU Commission has decided ensures an adequate level of protection for your personal information or
- we have put in place our own measures to ensure adequate security. This would include making sure that the processor keeps your personal information safe by imposing contractual obligations on the processor and by carrying out strict tests of compliance with our security requirements.
If we are transferring your personal information outside the EU, we will have let you know in the summary privacy notice that we gave to you when you provided the information to us or when we receive your personal information from someone else.
YOUR PRIVACY RIGHTS
- You have the following rights in relation to how we collect, hold and use your personal data. You have the right to ask us to
- confirm that we are using personal information about you, detail what that information is, to whom we have disclosed your information and a copy of the information that we have about you (The right of access)
- correct any incorrect or misleading personal information that we have about you (The right to rectification)
- stop using any or all of your personal information (The right to object)
- to delete or destroy your personal information (The right to erasure) and
- stop using your personal information until we can look into correcting your personal information or our justification for using your personal information or to stop us deleting your personal data where you need it in connection with any legal claims (the right of restriction) and
- pass your personal information to someone else (the right to data portability).
These are your rights in more detail:
| Right | Explanation |
| The Right of Access | This is your rightto know whether we are using your personal information and to know whyto know what categories of personal information are being used by have access to your personal datato know who have we disclosed or intend to disclose your personal information to andto obtain a copy of your personal information as used by us |
| The Right of Rectification | This is your right to request us to rectify any incomplete or inaccurate personal information about you |
| The Right to Erasure | This is your right to request us to erase personal data that we use about you where we cannot justify holding and using your personal information. You also have the right to request that we delete or destroy all of the information that we have collected and use on the basis, and only on that basis, that you have given us consent to do. |
| The Right of Restriction | This is your right to request us to restrict our use of your personal information until such time as a dispute about accuracy or our use of your personal information can be established |
| The Right to Object | This is your right to object to us about our use of your personal information based upon your particular circumstances |
| The Right to Data Portability | This is your right to request us to provide you or another person, body or organisation with your personal information. However, you only have this right where we have told you that the information is necessary for a contract between us or you have given consent to us collecting and using your personal information. |
We have 1 month (in complex cases, we can extend this time limit by another 2 months) to respond to your requirements. If we extend the time limit to respond, we will let you know prior to the expiry of the original month.
In our response to you, we will tell you whether we are complying with your request (either in whole or in part or not at all). We can refuse requests in relation to these rights but only where we can justify doing so. We will explain to you in our response any reasons for not complying with your requests.
You should contact our Data Protection Officer (DPO) if you wish to exercise any of these rights. Details of the DPO are available under Useful Informationat the end of this notice.
You must make your request in a permanent format such as a letter, email or a form provided by us, either paper or electronic, available on our website here. Whatever the means used, you must provide proof of your identity or allow us the opportunity to contact you to verify it.
MAKING A COMPLAINT
You can complain about how we have used your personal information. You should contact our Data Protection Officer (DPO). Details of the DPO are available under Useful Information at the end of this notice. You must make your complaint in a permanent format such as a letter or email or a form provided by us, paper or electronic, available on our website here. We will respond to you after seeking the advice of the DPO in relation to our actions.
If you remain unhappy about our response to your complaint, you can contact the Information Commissioner.
USEFUL INFORMATION
Contact Details of the DPO
The Data Protection Officer
East Renfrewshire Council
Council Headquarters
Eastwood Park
Giffnock G46 6UG
or by email at DPO@eastrenfrewshire.gov.uk
Contact Details of the Information Commissioner
For independent advice or to lodge a complaint about data protection, privacy and data sharing issues, you can contact the Information Commissioner’s Office (ICO) at:
Information Commissioner’s Office
Wycliffe House
Water Lane Wilmslow
Cheshire SK9 5AF
Tel: 0303 123 1113
Email: casework@ico.org.uk
Alternatively visit: https://ico.org.uk