Privacy policy

South Ayrshire Council is a local authority established under the Local Government etc. (Scotland) Act 1994. South Ayrshire Council is the data controller (contact details below). This means it decides how your personal data is processed and for what purposes. The Council is registered with the Information Commissioner's Office as a data controller - Z5548592.

Contact us:

County Buildings
Wellington Square
Ayr
KA7 1DR.

Email: DataProtection@south-ayrshire.gov.uk
Telephone: 0300 123 0900

The Council's Data Protection Officer can be contacted at the above postal address or by:

Email: DataProtection@south-ayrshire.gov.uk
Telephone: 01292 612223

Your personal data - what is it?

Personal data is information relating to a living person who can be identified from that data. Identification can be based on the information alone, or in conjunction with any other information. The processing of personal data is governed by the General Data Protection Regulation 2016 (GDPR) and supplemented by the Data Protection Act 2018.

What information will we collect from you?

We need you to give us your personal information in order to allow us to provide services to you as the local authority for South Ayrshire. We collect personal information about you in many ways. In most cases, we will collect it directly from you, in person, by telephone, on a paper or online form, by email or letter, or on CCTV. However, there will be cases when we receive information about you from someone else, or from one of our partners.

We collect different categories of personal information, depending on the service we provide to you.

We also use your information to verify your identity where required, contact you by post, email or telephone and to maintain our records.

For a number of areas of activity, we also receive information from third parties. In the main this is from other public authorities, such as the police and court service, HM Revenues and Customs and the Department for Work and Pensions. However, it could also be from other local authorities and from members of the public. Our service specific privacy notices give further detail on what kind of information is collected about you.

When we collect information from you, we will ensure we comply with the data protection principles:

• We will only collect information that we need.
• We won't keep your information for longer than we need it.
• We will tell you why we need your information and what we will do with it.
• We will keep your personal information secure.
• We will keep your information up-to-date.
• We will not use the information for a different purpose than the one we told you about (unless we have to do so by law).

How will we use your information?

We need to process personal information about you to enable us to provide services and meet our legal obligations, such as collecting Council Tax, paying benefits and grants, and dealing with planning and licensing applications.

It will sometimes be necessary to process personal information to protect individuals from harm or injury, to prevent and detect crime, to comply with legal orders and duties, and to provide information in accordance with a person's rights.

We also have a duty to manage public funds, prevent and detect fraud so we may share the information you have provided with relevant bodies as is permitted by law.

Sometimes, we may need to keep your personal information within the Council's Archives for evidential and historical reasons, or use it for research and statistical purposes.

What is the legal basis for processing (using) your information?

We will only process your personal information when there is a lawful reason to do so:

• It is required by law.
• It is necessary to provide a Council service.
• It is necessary as part of a contract.
• It is necessary to protect someone's life.
• You have given us permission to do so.
• We have a legitimate interest to do so.

Who will we share your information with?

To provide you with efficient services, we will sometimes share your personal information between teams within the Council, and with external partners and agencies involved in delivering services on our behalf, or alongside us. We may also provide personal information to third parties, but only where it is necessary to comply with the law or where it is allowed by data protection law.

We have a duty to protect public funds. We may check your information within the Council for verification purposes and/or for the prevention of fraud. We may share your information with other organisations where we are required to do so for the purposes of the prevention or detection of crime.

By way of example, we may share your information with:

• NHS
• Police Scotland
• Department for Work and Pensions
• Her Majesty's Revenue and Custom (HMRC)
• Voluntary organisations and care providers

Our service specific privacy notices give further information about the organisations with whom we may share personal information.

We will only share information with partners or contractors who agree to protect your information. Their duties will be set out in contracts or information sharing agreements.

How long do we keep hold of your information?

We will not keep your information for any longer than it is needed, and will dispose of paper and electronic information in a secure way. The length of time we need to keep information will depend on the purpose for which it is collected. Your information will be retained in line with our Corporate Records Retention Schedule.

Our service specific privacy notices give further information on how long we keep your information.

What are my rights?

You can ask the Council to:

• Rectify your personal information if it is inaccurate;
• Access your personal information held by us
• Complete your personal information if it is incomplete;
• Restrict the processing of your personal information in certain circumstances;
• Erase your personal information in certain circumstances.
• Right to object to the processing of your personal information

You also have in certain circumstances, the right to data portability, which means that you have the right to ask the Council to provide you with your personal information in a commonly used and machine-readable format.

What about Automated Decision-Making?

We make some use of automated decision-making processes but very little use of profiling. Where these techniques are used, this will be explained in the specific privacy statements relating to those functions, together with a description of the reason involved in any automated decision-making.

Do you require this statement in a different format?

Please contact us if you require this information in an alternative format.

How can you get in touch with us?

If you wish to obtain any records held by the Council relating to you, or if you have any general data protection queries, please contact the Council's Data Protection Service at:

Data Protection Officer
South Ayrshire Council
County Buildings
Wellington Square
Ayr
KA7 1DR

Email: DataProtection@south-ayrshire.gov.uk
Telephone: 01292 612 223

If you have a complaint

If you are unhappy with the way the Council has dealt with your personal information, you can complain to the Data Protection Officer using the contact details noted above. If you remain dissatisfied, you have the right to complain to the Information Commissioner (https://ico.org.uk/for-the-public/):

Information Commissioner's Office
45 Melville Street
Edinburgh
EH3 7HL

Email: scotland@ico.org.uk
Telephone: 0131 244 9001

If you have no internet access

Please contact us at the above postal address or telephone number if you wish to have copies of any of the above information and you do not have access to the internet. We will endeavour to let you have hard copies of the information.