Privacy Statement for Clients

In order to provide an effective service to help you achieve your goals, we need to record and store data about you. This document tells you how we store and share this information in accordance with the General Data Protection Regulation 2018. It also explains how you can go about viewing this data. If you have any questions please ask your caseworker, if these questions arise at a later date please feel free to call the project. Contact details are at the end of this notice.

This document is for you, a copy will be kept by the project. It explains to you:

• what the data you have provided will be used for

• what your rights are in terms of accessing the data

• it explains who we are, the networks that we are part of and who in terms of data protection the Data Controller is.

Benefits to You

Allowing us to store and share your data means that we can provide you with a wide range of personalised information and services which may include;

• Employment and employability support

• Volunteering opportunities

• Local courses

• Skills training

• Specialist support

• Financial help

We are able to call upon partner organisations, where appropriate, to provide you with additional support to help you progress and, with your permission, pass information across so that partners are aware of what support you have received and what your goals are.

Collection and Storage of Data

• We collect and store data you have given us on paper files which are held securely within our offices.

• In addition, your data will be stored on ‘HELIX’, a Management Information System developed by Hanlon software and managed by Capital City Partnership. This system allows Capital City Partnership, the Local Authority supporting your service and CCP to monitor services for people wishing to progress into volunteering, employment, training etc. or for people currently in work but may require some assistance to stay in work.

• We may store information related to employability services you receive as well as your contact details, other personal data for example, your age, gender, National Insurance Number as well as sensitive personal data (for example, about your health, ethnicity and religion)

• You can see and amend any of this information at any time, simply contact your caseworker to discuss what you will need to do.

• This information will be retained on HELIX no longer than 7 years after your last support session or for some projects this will be 7 years after a particular project has finished. This is to allow the organisations who fund the project to Audit the records.

• In most instances the recording on HELIX is mandatory and is a condition of funding for the project as it will allow us to evidence to our funders (CITB) what we have done with public money.

• The information is held securely on an ISO27001 and ISO9001 certified data hub accessed through a security vetted data transfer protocol.

• On certain occasions, the data on HELIX will be collated, anonymised and used to provide reports on progress towards achieving strategic goals and help to better inform policy and future actions.

• Data is stored within the UK.

Sharing of Data

• Whilst we are an independent organisation, we are part of the wider Joined Up for Jobs network that provides support in Edinburgh and the Lothians. This is a group of services who help people into work, voluntary activities, training etc.

• Personal information given to us will be used to check whether you already have a record on HELIX through working with another organisation.

• If it is appropriate, we may share your data in order to match you to job and volunteering opportunities, training courses etc. and also to verify your outcomes for our funding partners.

• We may share your data with funding organisations such as Construction Training Industry Board (CITB) to allow them to audit and check on where money has been spent. This could include third party evaluators acting on behalf of a funding organisation.

• Each employability organisation is a separate data controller for the data that they hold about you and you are required to read and sign a privacy notice for each one.

Conditions of Processing

Our legal basis for processing your information is:

• 6 (1) (e) It is necessary for the performance of a task which we carry out in the public interest as part of our official authority

• 9 (2) (j) It is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, with appropriate safeguards in place.

Your Statement of Understanding

On the registration form that you have completed, you will have signed to allow us to hold and process information about you. You can rest assured that the information that you give us will remain confidential according to the 2018 GDPR. All information is treated in the strictest of confidence by Capital City Partnership (the data processor) CCP. The information we record is stored on HELIX and only authorised members of staff of the services that you use have access to your client record via secure logins.

Please read the following carefully and then sign and date the form on Page 3. If you have any concerns please discuss them with a member of staff.

1. I understand that CCP can hold electronic and paper records about me for the purpose of providing me with a service related to:

i. Employment and employability support

ii. Volunteering opportunities

iii. Local courses

iv. Skills training

v. Specialist support

vi. Financial help

2. I understand that the information provided by me may be shared with other service providers who can contribute to my employment, volunteering, training and education opportunities.

3. I understand that in some cases CCP may need to contact my employer, college, placement etc. to verify an outcome. Due to funding criteria, CCP would need to verify employment for example at start, 4 weeks and 13 week periods. If verification cannot be obtained from your employer then I may have to provide payslips.

4. I understand that this information will primarily be used only for the purposes of providing a service to me but may also be used for monitoring and statistical purposes.

5. I understand that I have a right to restrict what information may be shared and with whom.

6. I understand that I have a right to review all information and records about me subject to providing a satisfactory notice period to Capital City Partnership, as stated in the 2018 GDPR.

Subject Access Request

If you, as the client, require access to the data stored in relation to the support you are receiving, in the first instance you should contact your caseworker who will be able to assist you.

Alternatively you can contact:

Chris Nicol, Business Information, Capital City Partnership, Great Michael House, 14 Links Place, Edinburgh EH6 7EZ, chris.nicol@capitalcitypartnership.org.

All requests should be in writing and you should receive a response within one month.

If you have any complaints, feel that data is being held against your wishes or generally want some advice, please look at the Information Commissioners Website https://ico.org.uk/for-the-public/personal-information/

The Information Commissioners Office are the UK’s independent authority set up to uphold information rights in the public interest, promoting openness by public bodies and data privacy for individuals.