Who is collecting and using your personal data?

Devon County Council (DCC) is collecting and or processing your personal data as a Data Controller under UK General Data Protection Regulations (UK GDPR) and our ICO registration number is Z6475582. This privacy notice concerns the processing of personal data that takes place by the Family Hubs.

This notice explains what information we collect, why we collect it and how we keep it secure. It also explains your rights and our legal obligation. Should you wish to find out more about Devon County Council’s data protection policies please contact our Data Protection Officer.

Please note that failure to provide your personal data may make it difficult for us to provide the right advice and support or could place a child or someone else at risk or undermine a police investigation.

We will notify you of any changes to this privacy notice

This privacy notice was last updated on 20 March 2025. If we use your personal data for any new purposes, updates will be made to the policy information and changes communicated, where necessary in accordance with current UK GDPR legislation. Any queries relating to this privacy notice please contact the Data Protection Officer.

What information are we processing?

We may collect, store or otherwise process information about you which may include:

personal and special category data, including name, address, date of birth, religion, ethnicity, gender, job role and organisation, telephone numbers, email addresses and disabilities,
information about requests for early help, targeted services or safeguarding concerns and risk

Purpose of collecting or processing your personal data

We collect and process your personal information for the following purpose(s):

To support your child or young person’s development.
To meet your child or young person’s health and social care needs.
To provide appropriate care and support to you and your child or young person.
To keep your child or young person safe.
To meet the legal duties placed upon us to provide a full child health and family support services.
Progress applications (employment, volunteering, fostering, adoption) or any other enquiries.
To assess the quality of the services we are providing.
Learn how to improve our services.
To prepare statistics on performance internally and for central government.
To audit services and ensure they remain fit for purpose in the future.
To monitor how we spend public money and ensure best value is achieved.
To plan and manage the services delivered by Devon County Council and or partners.
To help develop professionals and employees within Devon County Council and our partners.
To conduct research and development on the services we provide.

The council and its partners use information about children and families for the wider purpose of planning, delivering and reviewing services for children and families, for example:

Claim free childcare entitlement for 2-, 3- and 4-year-olds.
Identify children’s needs through Integrated Health Checks.
Identify children and family’s needs through Children’s Learning and Well-Being Audits.
Safeguard children.
Provide inclusion support.
Inform Early Years Planning and Review Meetings.
Support effective transitions.
Ensure public funds are administered and spent in line with any Statutory Guidance or Codes of Practice

We will also be performing evaluations of the services currently offered to families. As part of this process, we will ask individual families if they would be happy to support these evaluations. The evaluations will be undertaken with the consent of those concerned.

The legal basis for us collecting your personal data

Reason for using your personal data	Data protection law that allows us to process your personal data	Data protection law that allows us to process your personal data
We encourage Children and families to engage with Family Hubs so we can evidence requests for support and develop services based on local need.	Article 6(1)(e) of the UK GDPR -to do so is necessary for the performance of a task carried out in the public interest, or in the exercise of official authority	Section 1 of the Childcare Act 2006 Statutory guidance: Sure Start children’s centres: guidance for local authorities
To safeguard or promote the welfare of any child or adult in Devon.	Article 6(1)(e) of the UK GDPR -to do so is necessary for the performance of a task carried out in the public interest, or in the exercise of official authority	Section 10 and Section 11 of the Children Act 2004. Section 1 and Section 2 of the Care Act 2014
To identify, assess and support young carers, young adult carers and their families	Article 6(1)(c) of the UK GDPR – to do so is necessary because of a legal obligation that applies to the Council	The Children and Families Act 2014
To track individual children’s development.	Article 6(1)(c) of the UK GDPR – to do so is necessary because of a legal obligation that applies to the Council	Early years foundation stage statutory framework (EYFS).
Any involvement in any research projects or evaluations.	Article 6(1)(e) of the UK GDPR – necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller (Data Protection Act 2018 Clause 7).	Section 35 of the Digital Economy Act 2017
Collection of information if you or your child has an accident and report this to relevant bodies to ensure public safety.	Article 6(1)(c) of the UK GDPR – to do so is necessary because of a legal obligation that applies to the Council	Health and Safety Executive (HSE) under the Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 2013

Reason for using your special category data	Data protection law that allows us to process your personal data.	UK Legislation that supp
We may ask you to provide further information about yourself in order to offer you support for you or your child under the remit of supporting child development, providing early help or the identification and support for stronger families; and any volunteering opportunities. Such as race and ethnic origin, religious or philosophical beliefs, health data	Article 9(2)(a) of the UK GDPR – the data subject has given explicit consent to the processing	The Children’s Act 2004. Part 1 of schedule 1(1) of the Data Protection Act 2018
In order to safeguard child and vulnerable adults we may record if you have a status of need and involved in statutory services.	Article 9(2)(b) of the UK GDPR – processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law.	The Children’s Act 2004 Section 35 of the Digital Economy Act 2017 Part 1 of schedule 1(1) of the Data Protection Act 2018
Using data collected to help understand if services are making a difference to you and your family	Article 9(2)(i) of the UK GDPR – processing is necessary for reasons of public interest in the area of public health	Health and Social Care Act 2012; Section 12 Duty to Improve Public Health The Local Authorities (Public Health Functions and Entry to Premises by Local Healthwatch Representatives) and Local Authority (Public Health, Health and Wellbeing Boards and Health Scrutiny) (Amendment) Regulations 2015

Where the legal basis is consent of the data subject

The Council collects and uses information about you on the basis that you have given us your consent to do so. You may withdraw your consent and ask us not to use information about you for Family Hub services by either a letter addressed to the Family Hub Locality Manager or an email to familyhubsdevon@devon.gov.uk.

Recipients or categories of recipients that we may share your personal data with

To deliver services to you or protect individuals if there are concerns, they may be at risk of significant harm and to keep those individuals and the wider public safe it may be necessary to share your information with one or more of our partner organisations:

Education providers such as:

Nurseries and pre-schools
Schools
Colleges
Health services such as:
Integrated Care Boards
Healthcare trusts
Hospital trusts
GPs
Health visitors and other health professionals
Criminal Justice agencies such as:
Devon and Cornwall Police
Youth Offending Service
Probation or community rehabilitation company

Partner agencies such as:

Government agencies who provide funding for our services
Commissioned services (organisations that we ask to provide services on our behalf)
Child Protection Conferences and Child in Need meetings. Should you have involvement with social care services, we may be requested to let them know about your attendance at sessions. You will be fully informed of this.
Community and voluntary sector
Job Centre Plus
District councils
Housing providers
Domestic abuse services
Substance misuse services
Any other support agencies that are relevant to you and your family’s needs.

If we feel that it is necessary to share your personal data with professionals to ensure you or someone you work with is safeguarded from harm, we rely upon the provisions of the Safeguarding Vulnerable Groups Act 2006 and Children Act 1989 & 2004.

Where it is necessary to share medical or social care information for these purposes, we rely upon article 9(2)(h) of the UK GDPR (information necessary for medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems).

We may also share information to enable us to comply with court orders and other legal obligations. If this is necessary, we will only share the minimum amount of personal data needed for this purpose.

How long will we hold your personal data?

We will retain your personal data for only as long as necessary and in line with our organisation’s record retention schedules.

Automated decisions

No automated decisions are made using the personal data you provide for the above purposes.

Your data protection rights

Under UK General Data Protection Regulations, you have the right to obtain a copy of your personal records held by us, this is called a Subject Access Request (SAR). Find out more information about your data protection rights.

Complaints

If you have any comments, queries or complaints about this privacy notice or the processing of your personal data please contact our Data Protection Officer.

Alternatively, if you are not happy with the way that DCC is handling your personal data, you are entitled to appeal to the Information Commissioners Office (ICO). The Information Commissioners Office enforces and oversees the UK General Data Protection Regulations.

For more information about how to contact a complaint please visit the ICO website.