IRES Data Sharing & Privacy Notice Capital City Partnership

In order to provide an effective service, we need to record and store data about your organisation. This document tells you how we store and share this information in accordance with the Data Protection Act 1998 and the General Data Protection Regulation 2018. It also explains how you can go about viewing this data. If you have any questions, please ask your named associate in CCP. If any queries arise at a later date, please feel free to get in touch with the project. Contact details are at the end of this notice.  

This document is available for your business if required, and a copy will be kept by the project. It explains to you 

• what the data you have provided will be used for. 
• what your rights are in terms of accessing the data.
• it explains who we  are, the networks that we are part of and who in terms of data protection      
• who the Data Controller is.

Benefits to You

Allowing us to store and share your business and project data means that we can provide you with a wide range of personalised information and services which may include: 

• Skills training
• Specialist support
• Financial help
• Facilitation
• Strategic development
• Network engagement

We are able to call upon partner organisations, where appropriate, to provide you with additional support to help you progress and, with your permission, pass information across so that partners are aware of what support you have received and what your goals are. 

Collection and Storage of Data

• We collect and store data you have given us on electronic files which are held securely within our CRM system ‘Hanlon’ and ‘HELIX.
• ‘Hanlon’ and ‘HELIX’, are Management Information Systems developed by Hanlon software and managed by CCP. This system allows CCP, the Local Authority supporting your service, the Integrated Regional Employability and Skills programme(IRES) to monitor services and activities for businesses wishing to engage with the project. 
• We may store information related to skills, employability and support services you receive.
• You can view and amend any of this information at any time, simply get in touch with your lead contact to discuss what you will need to do.
• This information will be retained on Hanlon / HELIX no longer than 7 years after your last support session or for some projects this will be 7 years after a particular project has finished. This is to allow the organisations who fund the project to Audit the records. 
• In most instances, the recording on Hanlon / HELIX is mandatory and is a condition of funding for the project as it will allow us to evidence to our funders what we have done with public money.
• The information is held securely on an ISO27001 and ISO9001 certified data hub accessed through a security vetted data transfer protocol.
• On certain occasions, the data on Hanlon / HELIX will be collated, anonymised and used to provide reports on progress towards achieving strategic goals and help to better inform policy and future actions.
• Data is stored within the UK.

Sharing of Data

• Whilst we are an independent organisation, we are part of the wider Edinburgh and South East Scotland City Region Deal that provides support to businesses across Edinburgh, East Lothian, Fife, Midlothian, Scottish Borders and West Lothian.
• Personal and business information given to us will be used to check whether you already have a record on Hanlon / HELIX through working with another organisation.
• If it is appropriate, we may share your data in order to verify your outcomes for our funding partners.
• We may share your data with funding organisations to allow them to audit and check on where money has been spent. This could include third party evaluators acting on behalf of a funding organisation.

Conditions of Processing

Our legal basis for processing your information is:

· 6 (1) (e) It is necessary for the performance of a task which we carry out in the public interest as part of our official authority.

· 9 (2) (j) It is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, with appropriate safeguards in place

Your Statement of Understanding

On the project proposal and/or grant award paperwork that you have completed, you will have signed to allow us to hold and process information about you or your business. You can rest assured that the information that you give us will remain confidential according to the Data Protection Act 1998 and 2018 GDPR. All information is treated in the strictest of confidence by CCP (the data processor) and the IRES project team. The information we record is stored on Hanlon / HELIX and only authorised members of staff of the services that you have had contact with can access your record via secure logins.

Please read the following carefully and then sign and date the grant award paperwork. If you have any concerns please discuss them with a member of staff. 

1. I understand that the IRES project team can hold electronic and paper records about me for the purpose of providing me/my business with a service related to: 

i. Employment and employability support

ii. Volunteering opportunities

iii. Local courses

iv. Skills training

v. Curriculum development

vi. Sector awareness

vii. Feasibility Studies

viii. Specialist support

ix. Financial help

2. I understand that the information provided by me/my business may be shared with other service providers who can contribute to my employment, volunteering, training, business support and education opportunities.

3. I understand that this information will primarily be used only for the purposes of providing a service to me/my business but may also be used for monitoring and statistical purposes.

4. I understand that I have a right to restrict what information may be shared and with whom. 

5. I understand that I have a right to review all information and records about me subject to providing a satisfactory notice period to CCP, as stated in the Data Protection Act 1998.

Subject Access Request

If you, as the client or business, require access to the data stored in relation to the support you are receiving, in the first instance, you should contact your lead contact who will be able to assist you.

Alternatively, you can get in touch with: 

Chris Nicol, Business Intelligence Manager, Capital City Partnership, Great Michael House, 14 Links Place, Edinburgh, EH6 7EZ

All requests should be in writing and you should receive a response within one month. 

If you have any complaints, feel that data is being held against your wishes or generally want some advice, please look at the Information Commissioners Website https://ico.org.uk/for-the-public/personal-information/

The Information Commissioners Office are the UK’s independent authority set up to uphold information rights in the public interest, promoting openness by public bodies and data privacy for individuals.