This privacy notice explains your rights and is intended to provide you with the information you are entitled to under UK data protection laws.

Please note that privacy notice only relates to your personal data (your name, address and anything that could be used to identify you personally), not the other contents of your UK Community Renewal Fund application.

Devon County Council (DCC) is collecting and or processing your personal data as a Data Controller under Data Protection Legislation and our ICO registration number is Z6475582. This privacy notice concerns the processing of personal data that takes place by Devon County Council’s Economies, Enterprise, and Skills Service.

This notice explains what information we collect, why we collect it and how we keep it secure. It also explains your rights and our legal obligations under data protection laws.

The identity of the data controller and contact details of our Data Protection Officer

If you wish to find out more about Devon County Council’s data protection policies please contact our Data Protection Officer whose contact details are below:

Martin Lawrence (Data Protection Officer)
Tel: 01392 383000 (ask for Martin Lawrence)
Email: keepdevonsdatasafe@devon.gov.uk

Data Protection Officer
Data Protection and Cyber Security Team

Room 120, County Hall
Topsham Road
Exeter
EX2 4QD

The Ministry for Housing Communities and Local Government is a joint data controller for all UK Community Renewal Fund related personal data collected only where an application is submitted by Devon County Council as the Lead Authority.

Why are we collecting your personal data?

Your personal data is being collected as an essential part of the UK Community Renewal Fund bidding process, so that we can contact you regarding your bid and for monitoring purposes. We may also use it to contact you about matters specific to the Fund.

Devon County Council will process all personal data according to the provisions of the Data Protection Act 2018 and the UK General Data Protection Regulation 2018 (UK GDPR) and all applicable laws and regulations relating to processing of personal pata and privacy, including, where necessary, the guidance and codes of practice issued by the Information Commissioner and any other relevant data protection regulations (together “the Data Protection Legislation (as amended from time to time)”).

The Data Protection Legislation sets out when we are lawfully allowed to process your data. The lawful basis that applies to our processing of your personal data is outlined below.

Section 111 of the Local Government Act 1972 creates a legal power for Devon County Council to do anything reasonable to enable it to discharge its statutory functions as a Local Authority.

The Council considers that the processing of your personal data as part of the UK Community Renewal Fund process is necessary for the Council to deliver this public function. For this reason, we feel that the processing of your personal data is lawful on the grounds that article 6(1)(e) of the UK General Data Protection Regulation applies (processing that is necessary for the performance of a public task carried out in the public interest).

Who will we share your personal data with?

As part of the process of selecting and monitoring the UK Community Renewal Fund, Devon County Council will share your personal data with relevant government departments including:

The data mae also be shared with departments in the Devolved Administrations, and contractors where they are used for monitoring purposes, to evaluate the programme. Their contract will set out what they are permitted to do with any personal data that is shared with them.

If we feel that it is necessary to share your personal data with professionals to ensure you or someone you work with is safeguarded from harm, we rely upon the provisions of the Safeguarding Vulnerable Groups Act 2006 and Children Act 1989 & 2004. Where it is necessary to share medical or social care information for these purposes, we rely upon article 9(2)(h) of the General Data Protection Regulation (information necessary for medical

diagnosis, the provision of health or social care or treatment or the management of health or social care systems).

We may also need to share some personal data about you, so that we can support third party organisations to discharge their regulatory requirements. This includes organisations such as:

The data protection regulator (the Information Commissioner’s Office)
The Care Quality Commission

We may also share information to enable us to comply with court orders and other legal obligations. If this is necessary, we will only share the minimum amount of personal data needed for this purpose.

How long will we keep your personal data?

If your bid is successful, your personal data will be held for up to two years from the closure of the bidding process. This is currently estimated to be July 2023. As part of the monitoring process, we will contact you regularly to ensure our records are up to date. Should your bid be unsuccessful, we will erase your personal data.

Your data protection rights

The data we are collecting is your personal data, and you have considerable say over what happens to it. Data protection laws grant you the following rights:

The right to be informed about how your personal data is being handled.
The right to request access to your personal data.
The right to request rectification of inaccurate or incomplete personal data.
The right to request the erasure of your personal data in certain circumstances.
The right to request restrictions on how your personal data will be used in certain circumstances.
The right to request the portability of your personal data in certain circumstances.
The right to object to how your personal data is being used.
The right not to be the subject of automated decisions including profiling involving your personal data.

For more information about your rights and how you can exercise them, please read our Data Subject Rights web page.

Your personal data will not be sent overseas. We will not use your data for any automated decision making or profiling.

Your personal data will be stored in a securely on Devon County Council IT infrastructure. If your personal data is shared with third parties, as set out in section 4 of this privacy notice, we require third parties to respect the security of your data and to treat it in accordance with the law. All third parties are required to take appropriate security measures to protect your personal data.

For more information about Devon County Council’s information security arrangements please read our Security web page.

Complaints and more information

If you are unhappy with the way Devon County Council is using your personal data, you can make a complaint through our Customer Feedback Policy and Procedure. For more details on how to make a complaint to Devon County Council visit our Customer Feedback web page.

If remain dissatisfied with the way that Devon County Council has handled your complaint, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO). You can also contact the ICO for independent advice about data protection, privacy, and data sharing.

The Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow, Cheshire,
SK9 5AF

Telephone: 0303 123 1113 or 01625 545 745
Website: https://ico.org.uk/