- What personal information do we collect?
-
We collect and process a range of information about you. This includes
- Identity and contact data such as your name, address and contact details, including email address and telephone number, date of birth, gender and ethnicity
- Information about you such as your marital status, religion, sexual orientation, next of kin and their emergency contact details
- Information about medical or health conditions, including whether or not you have a disability and your NHS number
- Marketing and Communications Data including your preferences in receiving marketing from us and our third parties and your communication preferences.
We collect this information in a variety of ways. For example, data is collected through referral forms and appointment forms, through discussions held with a staff member in person or by telephone, email, or post. We may also collect data from your GP, Adult Social Care teams, Multi-Disciplinary Teams and other Health and Social Care providers that refer you to the service.
- Why do we process personal data?
-
This service is voluntary however if you choose to engage with us, it will be necessary to process your information to carry out our public task. For example, we need to process your data to enable referrals or requests for services or support from other organisations to be provided, which will have been agreed with you in advance. We will also need to process personal data as part of the monitoring of performance in providing the Social Prescribing service. The Social Prescribing service is delivered in partnership with NHS GP practices, so this includes sharing your data with your GP. We may also provide feedback to the organisation or person that referred you to the Social Prescribing service. In some cases, we need to process data to ensure that we are complying with our legal obligations. For example, we have a duty to report safeguarding concerns to the appropriate agency.
- Who has access to your personal data?
-
Where necessary your information may be shared with the parties set out below for the purposes stated above
- Your GP
- Surrey County Council (including Adult Social Care)
- North West Surrey Alliance
- Surrey Heartlands Health and Care Partnership
- Other departments within Runnymede Borough Council
- Emergency services
In addition, we may share your information with other borough councils and voluntary sector organisations where services you request or express an interest in are not provided directly by us.
If a change happens to our service, then the alternative provider may use your personal data in the same way as set out in this privacy notice.
We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions and data protection laws. They are also obliged to implement appropriate technical and organisational measures to ensure the security of data. We will not transfer your data to countries outside the European Economic Area.
- How do we protect personal data?
-
We take the security of your data seriously. The organisation has internal policies and controls in place to try to ensure that your data is not lost, accidentally destroyed, misused or disclosed, and is not accessed except by its employees in the performance of their duties. Data will only be processed by members of staff authorised by the Data Controller for this purpose. Access to our systems is limited to authorised members of the Independent Living team whose job role requires access to the personal data.
- How long do we keep your personal data?
-
We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements. By law we must keep basic information about our customers (including Contact and Identity data) for 7 years after they cease being customers for internal administration purposes
- Your rights
-
As a data subject, you have a number of rights, including access to your data. A request for access can be made via our website or by sending an email to foi@runnymede.gov.uk
Data Protection Subject Access Request(SAR) | Introduction – Runnymede Borough Council
To find out more about your rights please see the ‘Your Rights’ section of our main privacy statement
If you believe that Runnymede Borough Council has not complied with your data protection rights, you should initially try to resolve it with the relevant department.
If you are unable to resolve the issue to your satisfaction contact our Data Protection Officer (DPO) who will investigate. If you remain dissatisfied with the outcome of the DPO’s review you can make a complaint to the Information Commissioner. You can find out further information on making a complaint to the Information Commissioner on their website Information Commissioner's Office (ICO)