Privacy notice - Sussex and Brighton Strategic Authority (SBSA) Funded Business Support Programmes
Overview
This Privacy notice covers the processing of data carried out as part of programmes funded by the Sussex and Brighton Strategic Authority (SBSA). East Sussex County Council commissions external delivery providers to deliver these programmes on its behalf. These providers are required to handle personal data securely and in accordance with the General Data Protection Regulation (GDPR). Please note that this privacy notice covers only personal data that is processed in connection with the programmes funded by the Sussex and Brighton Strategic Authority.
East Sussex County Council takes data protection seriously. Please be assured that your information will be used appropriately in line with data protection legislation, will be stored securely and will not be processed unless the requirements for fair and lawful processing can be met.
What information is being used?
Organisations commissioned by East Sussex County Council to deliver the business support programmes will collect personal information from participants on the Council’s behalf. This will normally include the participant’s name, telephone number and email address, along with the business address, relevant business details and a record of the support provided. Business details are required to receive the service, and a narrative of support will be recorded.
As part of monitoring the reach of our services we will ask for special category data for equality and diversity monitoring. This information is optional and is not a requirement of receiving the service.
How will your information be used?
We hold your information so that we can provide the services, and keep in contact with participants.
Your personal data will be used by the organisation delivering your programme on behalf of East Sussex County Council. It will be used for operational purposes, including contacting you, providing ongoing support and collecting feedback by email. Aggregated information will also be used to provide evidence of service delivery to the funder, the Sussex and Brighton Strategic Authority. This information will not identify individual participants or businesses.
Business information may be matched with other data sources to help us understand more about organisations like yours and identify general patterns and trends. The information will not be published in a way that identifies you or your business.
Personal and special category data will be used by the relevant service provider and East Sussex County Council to understand the reach of our services and promote equality and diversity.
We aim to maintain high standards, adopt best practice for our record keeping and regularly check and report on how we are doing. Your information is never sold for direct marketing purposes.
Our staff are trained to handle your information correctly and protect your confidentiality and privacy.
Your information is processed in the UK or in a country with an adequacy agreement with the UK.
What is the legal basis for processing your information?
Your personal data is processed under Article 6(1)(e) of the UK General Data Protection Regulation (UK GDPR), necessary for the performance of a task carried out in the public interest.
Processing is necessary for ESCC to exercise its public functions in supporting economic development and delivering business-support programmes. ESCC’s statutory authority is provided by the general power of competence under section 1 of the Localism Act 2011. The programmes are funded by the Sussex and Brighton Strategic Authority and delivered through commissioned providers on ESCC’s behalf.
Where you choose to provide optional special category data, we process this with your explicit consent under Article 9(2)(a) of the UK GDPR. You may withdraw your consent at any time.
How long will your information be kept for?
Personal data will normally be held for 10 years, as per the programme's retention schedule. For more information on how long information is retained please see the East Sussex County Council retention schedule.
Sharing your information
Your personal information will be collected by the organisation commissioned to deliver your programme on behalf of East Sussex County Council and shared with the Council, for monitoring and reporting purposes. It will not be shared with organisations delivering other programmes or with the funder. The Sussex and Brighton Strategic Authority will only receive aggregated monitoring information that does not identify individual participants or businesses.
Any sharing of personal data is always done:
- on a case-by-case basis
- using the minimum personal data necessary
- with the appropriate security controls in place
- in line with legislation.
Information is only shared with those agencies and bodies who have a "need to know" or where you have consented to the sharing of your personal data to such persons.
We may use the information we hold about you to assist in the detection and prevention of crime or fraud. We may also share this information with other bodies that inspect and manage public funds.
Use of third party organisations
East Sussex County Council may share your information with trusted external organisations to process your data on our behalf.
To provide the service, your personal data will be processed on East Sussex County Council’s behalf by the organisation commissioned to deliver the programme in which you participate. Only aggregated information, which will not identify individual participants or businesses, will be shared with the Sussex and Brighton Strategic Authority.
Any organisation commissioned by the Council will be under contractual obligation to comply with data protection legislation.
Your rights
Under data protection legislation, you have the right:
- to be informed why, where and how we use your information
- to ask for access to your information
- to ask for your information to be corrected if it is inaccurate or incomplete
- to ask for your information to be deleted or removed where there is no need for us to continue processing it
- to ask us to restrict the use of your information
- to ask us to copy or transfer your information from one IT system to another in a safe and secure way, without impacting the quality of the information
- to object to how your information is used
- to challenge any decisions made without human intervention (automated decision making)
Please visit data subject rights for further details.
How to find out more or complain
Should you have any further queries on the uses of your information, please speak directly to our service:
Economic Development
Community, Economy, and Transport
East Sussex County Council
County Hall
St Anne's Crescent
Lewes BN7 1UE
To complain about the use of your information, please contact our Customer Services Team or our Data Protection Officer.
Further information on making a complaint.
You can also contact the Information Commissioner's Office (ICO) for further information or to make a complaint:
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Phone: 0303 123 1113 (local rate)