Information and Advice Hub Privacy Notice

As the 'data controller' for the personal information - or data - we hold about you, South Ayrshire Council decides how your personal information is used/processed, and what it is used for. This statement provides more details about how we will use your personal data when you contact the Information and Advice Hub with an enquiry, an application or would like us to act on your behalf as an Agent.

Your Personal Data - what is It?

Personal data is information relating to a living person who can be identified from that data. Identification can be based on the information alone, or in conjunction with any other information. The processing of personal data is governed by the General Data Protection Regulation 2016 (GDPR) and supplemented by the Data protection Act 2018.

What Personal Data will we collect from you?

We will only collect the personal information we need to provide you with relevant advice, information, services and support. The personal data we may need to collect can include:

How will we use your information?

All personal data is processed by our Information and Advice Hub Support Staff. We will only collect the personal data we need in order to provide the delivery of our services, this includes:

• To provide support, advice and deliver services to customers at first point of contact, including using our Sign Post Service.
• To create record of customer requests for audit purposes, and provide full history of services delivered to customers
• Liaising with service colleagues and partner organisations, as required to respond to your enquiry
• General communication with customers
• Acting as an Agent on your behalf (with your Agreement) for organisations such as the Department of Work and Pensions (DWP) and the Courts and Tribunals Service
• Acting as an Agent on your behalf (with your Agreement) to engage with your creditors when providing debt advice such as the Accountants in Bankruptcy and Money Advice Scotland

What is the legal basis for using/sharing your information?

The legal basis for sharing your information is dependent on your enquiry. However, the main reason is the processing is necessary for the performance of the council's public tasks and duties as per Article 6 (1) (e) of the GDPR, i.e. to provide you with the statutory services tasked to the provision of advice and general enquiry services through Information and Advice Hub.

Who will we share your information with?

Depending on the type of assistance we are providing to you, we will need to share your personal data with other organisations. These may include:

• South Ayrshire Council Housing
• NHS Ayrshire and Arran
• South Ayrshire Council Revenues and Benefits
• HMRC (Inland Revenue)
• Department of Works and Pensions (DWP)
• Courts and Tribunal Services (HMCTS)
• Seascape
• Stepping Stones for Families
• The Energy Agency
• Other council departments for grant administration
• External Audit for Scottish National Standards
• South Ayrshire Voluntary Action Group
• The Trussell Trust
• Ayrshire Housing
• Ayr Housing Aid Centre
• MacMillan Cancer Care

When acting as an Agent on your behalf for representations to the DWP or HMCTS we will seek a written Agreement from you to allow us to show these organisations we have been given your permission to act on your behalf, allowing them to share your personal data with us. If you fail to provide the correct information at first point, then the council may not be in a position to process your request appropriately, and this may have implications in accessing the services required.

How long do we keep hold of your information?

We will hold onto your personal information no longer than reasonably necessary. Currently we retain your records for 6 years, plus the current year, from the time of your case being closed.

What are your rights?

The lawful basis for processing/using your personal data directly impacts which rights are available to you. For example, some rights will not apply, in this case we are processing your data under pubic task we are not required to:

• erase your personal information.
• enable the right to data portability

However, you do have the following rights and can ask us to:

• correct your personal information if it is inaccurate;
• complete your personal information if it is incomplete;
• restrict the processing of your personal information in certain circumstances

You also have the right to object to the processing of your personal information. If we are processing your data under contract then you have the rights above and

• the right to data portability

What about Automated Decision-Making?

The council does not use profiling or automated decision-making. Some processes are semiautomated (such as data matching for the prevention or detection of fraud), but an actual person will always be involved before any decision is reached affecting any individual.

Do you require this statement in a different format?

Please contact us if you require this information in an alternative format.

How can you get in touch with us?

If you wish to obtain any records held by the council relating to you, or if you have any general data protection queries, please contact our Data Protection Service at:

Are you dissatisfied with the way your Personal Information has been handled?

If you are unhappy with the way we have dealt with your personal information, you can complain to the council's Data Protection Officer using the contact details noted above. If you remain dissatisfied after contacting us, you have the right to complain to the Information Commissioner (https://ico.org.uk/for-the-public/):

Information Commissioner's Office - Scotland
45 Melville Street
Edinburgh
EH3 7HL

Email: scotland@ico.org.uk
Telephone: 0303 123 1115