General privacy notice

This privacy notice is part of the council’s method of complying with your right to be informed about the types of information we use, why we use it and your rights when we use your personal information.

For detailed information about data protection and how we make sure we comply with legislation please see our Data Protection Policy.

Personal information

We need to use different types of personal information to deliver services. The least we may ask for is your name and address.

We may also ask for information to prove your identity or to make sure that you are entitled to or qualify for services that we provide. This could include information such as your date of birth, your family details, services being provided to you, your financial details and any dealings with us.

Sometimes we collect personal information that needs special protection. This could be about:

• your physical or mental health
• racial or ethnic origin
• trade union membership
• political affiliations/opinions
• religion or other beliefs
• criminal proceedings, outcomes and sentences

We strictly control the use of this type of personal information and will only use it in connection with specific services or licensing applications, unless we tell you otherwise. 
Departments that are likely to collect and use this kind of personal information would be:

• Education Resources in relation to school pupils and their families or others who have a significant relationship with the pupils
• Social Work Resources in relation to clients and their families or others who have a significant relationship with the client
• Finance and Corporate Resources in relation to employees and their families or others who have a significant relationship with the employees

Other Services will use this personal information to carry out statutory functions such as applications for a service or a licence.

Sometimes we collect your personal information because we need it to enter into a contract with you, for example setting up a payment. If you don’t give us the information, we will not be able to provide you with the service need.

How we gather your personal information

We get personal information:

• directly from you, for example when you fill out an application form
• from other people who are connected to you about a service they provide
• from people who are making a complaint about you
• other public bodies such as other councils (or parts of this council), Police Scotland, Audit Scotland and regulators such as the Scottish Social Services Council or the General Teaching Council.

We also collect some personal information by recording phone calls. We record calls for training and to improve our standards. We also record calls for monitoring things such as the timing of your call and what you said to us.

We collect personal information on our CCTV cameras which are used to deter and detect anti-social behaviour, to protect our buildings, employees and other people.

Our website also collects cookies. These are small text files that websites place on your device as you are browsing. They are processed and stored by your web browser. Cookies themselves are harmless and serve crucial functions for websites. However they can store a wealth of data, enough to potentially identify you without your consent. Cookies can also generally be easily viewed and deleted. For more information see our Cookies page.

How we use your personal information

When we ask you for personal information we will tell you why and how we will use it. 

We use your personal information when necessary to do so:

• when we need it to provide a statutory function or service including those to which you are entitled. If you don’t give us the information we will not be able to provide you with that service
• when we have to  comply with a legal obligation for example giving your information to Police Scotland or other third parties as a result of a warrant or court order
• when we are going to have or have a contract with you for a service
• we have to for the interests of third parties, if their interests outweigh your own personal rights and freedoms

If we are using personal information that needs special protection, we will only do so in the situations listed above and if we need to meet any other requirements of data protection law. 

Other reasons

Some other reasons to use your personal information include:

• providing a statutory function or service which is being carried out in the public interest even if you are entitled to it
• providing an occupational pension
• monitoring our compliance with equality laws
• providing confidential counselling, advice or support or similar services being carried out in the public interest
• answering enquiries from councillors and other elected representatives
• protecting the wellbeing of children and people at risk where we do not need your agreement – for instance because we cannot  ask you for your agreement as we do not know where you are or it is inappropriate for us to do so
• to protect the economic wellbeing of certain people where we do not need your agreement – for instance because we cannot ask you for your agreement as we do not know where you are or it is inappropriate for us to do so
• providing health and social care services or
• you have given us permission to use your protected personal information

There may be circumstances where we will only use your personal information and or sensitive personal information where you agree to us doing so. If you have been asked and agreed that we can use your personal information, you can change your mind at any time in the same way you first gave us your permission – this could be by phone, online form, letter and so on. You can also contact our Data Protection Officer (DPO).

Sharing your personal information

We will tell you when we first ask for your personal information if we will share it, who we will share it with and why.

We do not share personal information outside the UK. However, there may be times where we use a processor (someone who holds or uses the personal information on our behalf and under our instructions) or share it with organisations and they may be outside of the UK not necessarily within the EU.

Outside the EU

We will only use a processor outside the EU if:

• the processor or the place the information will be held is in a country that the EU Commission has decided has good enough protection for your personal information or
• we have put own measures in place to make sure the security is good enough. This would include putting a contract in place with the processor and by carrying out strict security tests

If we are transferring your personal information outside the EU, we will let you know when you first give us the information or when we get your personal information from someone else.

How long we will keep your personal information

By law we must not keep personal information longer than we need to. 

Sometimes these time limits are set by law.

Most of the time this means that we can only hold your information for as long as it takes to carry out the service or function you have asked for. Sometimes it can be longer, for example if auditors need to see records or if anyone could take action against us about the service we provided. 

Keeping your info

These are examples of how long we could keep your information:

• at least 6 months - if you applied for a job with us but didn’t get it. We keep this in case you complain to the Employment Tribunal
• at least 5 years from end of the provision of a service or other interaction with someone where that person could take legal action against us such as to sue us for money
• if any legal action is raised against us, the personal information will be kept until the case is closed
• sometimes we may want to archive personal information because it is in the public interest to do so. If we do this  we will let you know that this has been done and take steps to protect your rights and freedoms

We keep retention schedules that set out the periods of time that we keep personal information. You can ask to see these at any time. You can also ask us to be told about how we use your personal information.

Your privacy rights

You have the right to ask us to:

• tell you that we are using personal information about you, tell you  what that information is and who we have shared it with. You can also ask us for a copy of the information we have about you. This is called the right of access
• to correct any wrong or misleading personal information that we have about you. This is called the right to rectification
• stop using any or all of your personal information. This is called the right to object
• to delete or destroy your personal information under certain circumstances. This is called the right to erasure 
• stop using your personal information until we can correct your personal information, give you our reasons for using your personal information or to stop us deleting your personal data if you need it in connection with any legal claims. This is called the right of restriction. 
• pass your personal information to someone else under certain circumstances. This is called the right to data portability

Right of access

This is your right to

• know if we are using your personal information and to know why
• know what kinds of personal information we are using and to have access to your personal information
• know who have or intend to share your personal information with
• get a copy of the personal information we have about you

Right of rectification

This is your right to ask us to fix any incomplete or inaccurate personal information about you.

Right to erasure

This is your right to ask us to delete personal information where we cannot justify holding and using it or where we are only using your information because you have been asked and agreed to us doing so, you could ask us to delete all personal information that we use.

Right of restriction

This is your right to ask us to restrict our use of your personal information while the accuracy of the information is being established.

Right to object

This is your right to object to us about our use of your personal information depending on your circumstances

Right to data portability

This is your right to ask us to give your personal information to you, another person, body or organisation. You only have this right if we have told you that the information is needed for a contract between us or you have told us that it is OK to do so.

Response times when you exercise your rights

We have 1 month (in complicated cases, we can extend this to 3 months) to respond to you. We will let you know before the end of the first month if we need to extend the time we have to get back to you.

We will tell you if we will carry out what you asked, either all of it, part of it or not at all. We can refuse requests but only where we can justify doing so. We will explain any reasons for not carrying out your requests.

Making a complaint

You can complain about how we have used your personal information. You should contact our Data Protection Officer.  
You should contact the Information Commissioner if you are unhappy with our answer to your complaint.