GDPR Privacy Statement

Cornwall and Isles of Scilly People Hub

Privacy Statement

Introduction

The People Hub is committed to protecting the privacy and security of your personal information. This privacy notice describes how we collect and use personal information about you during and after your working relationship with us, in accordance with the UK General Data Protection Regulation (UK GDPR).

Data Controller and Data Processor

UK GDPR draws a distinction between a ‘controller’ and a ‘processor’ in order to recognise that not all organisations involved in the processing of personal data have the same degree of responsibility. The UK GDPR defines these terms:

a. ‘controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.

b. ‘processor’ means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

Who will control my data?

The Data Controller for all the information you provide is Cornwall Council, New County Hall, Treyew Road, Truro, TR1 3AY. Data Protection Registration Number: Z1745294.

Who will process my data?

Cornwall Council, through the People Hub team, will be providing direct support to you and will therefore be processing your personal data.

In addition, the People Hub Team have 12 different Delivery Partners, some of which will deliver support to you as part of the People Hub Connect to Work project.  These Delivery Partners will register you to the project and collect and process your personal data that is necessary to provide support.

The Delivery Partners will use the same People Hub client database as the Council uses to input your data so that the records are held securely and are in one place.  Specialist Delivery Partners contracted by Cornwall Council are required to maintain the same or equivalent levels of security in the processing of your data. The Delivery Partners may share data belonging to you with each other so that they can work effectively to provide support. If this happens, you will be made aware of it at the time.

What information may be collected?

Information collected by us may include:

a. Name, date of birth, and contact details

b. National Insurance number

c. Employment and education history

d. Residency and benefit status

e. Details of any support services you are receiving

f. Health information, disabilities, or learning difficulties (where relevant)

g. Ethnicity and other equalities monitoring data

h. Referral and case management information

We may also receive information from:

a. Referral partners (for example Jobcentre Plus, social care teams, health professionals)

b. Commissioned delivery partners

c. Other services you are engaged with

Why do you need my personal data?

The information you provide will be used to signpost, direct and/or deliver the employment and skills support services offered by the People Hub.

We use your information to:

a. Assess your eligibility and suitability for the programme

b. Provide tailored employment support

c. Monitor your progress and outcomes

d. Report to the Department for Work and Pensions (DWP) and other government departments

e. Evaluate and improve the programme

f. Ensure compliance with funding and legal requirements

g. Ensure that the project services are inclusive and are being accessed by all communities within Cornwall and the Isles of Scilly, as part of our obligations under the Equality Act 2010.

Who else will we share your information with?

We will only use this information in conjunction with the support that is offered and/or you receive from the People Hub. All partners are required to comply with data protection legislation and are subject to data sharing agreements. We may share your information with:

a. Commissioned delivery partners

b. Employers and training providers (with your knowledge)

c. Other organisations who may be able to support you (with your knowledge)

d. Government departments including DWP, DfE, and HMRC

e. Local authorities and health services

f. External evaluators of the project

g. Other organisations where required by law or for safeguarding purposes

Your data will be held within Cornwall Council’s secure network and the People Hub’s secure client database and will not be processed outside of the UK or the European Economic Area.  Access to your information will only be made by authorised members of staff who are required to process it for the purposes outlined in this privacy notice.

We may share your personal information with third parties where required by law, where it is necessary to administer the working relationship with you or where we have another legal basis under UK GDPR for doing so. “Third parties” include third-party services from Cornwall Council such as the Resettlement Team. With your further consent we may refer your data to third parties (e.g., training providers) to enable you to access the support you have agreed to.

How do we keep your data secure?

We have appropriate security measures in place to prevent personal information from being accidentally lost or used or accessed in an unauthorised way. We limit access to your personal information to those who have a genuine business need to know it. Those processing your information will do so only in an authorised manner and are subject to a duty of confidentiality.

We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so.

How long will you keep this information for?

We will retain your personal information for up to 6 years after the end of the programme, in line with government guidance and funding requirements. The 6 years ends on December 2036 and after this period your data will be securely deleted or anonymised.

Legal basis for processing

We collect and use your personal data under:

a. Article 6(1)(e) UK GDPR – Public task: processing is necessary for the performance of a task carried out in the public interest

b. Article 9(2)(g) UK GDPR – Substantial public interest: for processing special category data

c. Schedule 1, Part 2 of the Data Protection Act 2018 – Equality of opportunity or treatment

What are my data rights?

Your personal information belongs to you and you have the right to:

a. be informed of how we will process it;

b. request a copy of what we hold about you and in commonly used electronic format if you wish (if you provided this to us electronically for automated processing, we will return it in the same way);

c. have it amended if it’s incorrect or incomplete;

d. have it deleted (where we do not have a legal requirement to retain it);

e. withdraw your consent if you no longer wish us to process;

f. restrict how we process it;

g. object to us using it for marketing or research purposes;

h. object to us using it in relation to a legal task or in the exercise of an official authority;

i. request that a person reviews an automated decision where it has had an adverse effect on you.

If there is something I don’t understand

If you need help in understanding or completing this form, please contact the People Hub team on telephone number 0333 015 0699 or by emailing hello@peoplehub.info.

How do I exercise these rights?   

If you would like to access any of the information we hold about you or have concerns regarding the way we have processed your information, please contact:

Data Protection Officer
Cornwall Council
New County Hall
Truro
TR1 3AY

Tel: 01872 326424

Email: dpo@cornwall.gov.uk

I don’t agree with something

We would prefer any complaints to be made to us initially so that we have the opportunity to see if we can put things right. However, if you are unhappy with the way we have processed your information or how we have responded to your request to exercise any of your rights in relation to your data, you can raise your concerns direct with the Information Commissioner’s Office Tel No. 0303 123 1113 https://ico.org.uk/concerns/

Amendments To This Privacy Notice

We may update this Privacy Notice at any time and will notify you where we make any substantial changes. We may also notify you in other ways from time to time about the processing of your personal information.