Corporate Privacy Notice

Dartford Borough Council, Civic Centre, Home Gardens, Dartford Kent DA1 1DR

Legal Services, Dartford Borough Council, Civic Centre, Home Gardens, Dartford Kent DA1 1DR Contact the Council's Legal Services Department

Data Protection Officer, Dartford Borough Council, Civic Centre, Home Gardens, Dartford Kent DA1 1DR

Contact the Council's Data Protection Officer

Each notice on the menu below, sets out the purposes for processing personal information in the case of each service. Generally, this will be for one or more of the following purposes:

• To perform our statutory functions;
• To deliver services to you;
• To manage those services we provide;
• Confirm your identity;
• Process financial transaction such as invoices, payments and benefits;
• To train and manage the employment of our workers who deliver those services;
• To investigate any complaints you have about our services;
• To monitor spending on services;
• To check the quality of services;
• To plan services;
• Prevent and detect fraud, corruption and crime;
• To protect individuals from harm.

Each service specific privacy notice will identify one or more lawful bases for the processing of personal information. Generally, the lawful basis will be one or more of the following:

• consent;
• the processing is necessary for the performance of a contract with you or in order to take steps at your request prior to entering into a contract;
• the processing is necessary for compliance with a legal obligation to which we are subject;
• the processing is necessary in order to protect your vital interests or those of another individual;
• the processing is necessary for the performance of a task carried out by us in the public interest or in the exercise of authority vested in us;
• the processing is necessary for our legitimate interests or those of a third party. This will not apply to processing that we carry out in the performance of our tasks as a public authority (we have a Legitimate Interests Policy that sets out how this information will be handled)

We will generally only allow your personal information to be used by our staff who need it to perform their functions. We have the following arrangements:

1. A shared service between us and Maidstone Borough Council to deliver our payroll service. Maidstone Borough Council is a data processor for us and only processes personal information in line with our instructions
2. As joint data controller between us and Sevenoaks District Council for the delivery of services relating to Council Tax, Housing Benefit and Council Tax Support, including Discretionary Housing Payments (HB) and Exceptional Hardship Fund Payments (CTS), Fraud, Internal Audit and NNDR (Business Rates). We decide together all the purposes for using the personal information that we share and we decide together the broad ways in which that personal information will be used. On occasion, in accordance with section 6(2) of the Data Protection Act 2018, we may be prevented from sharing and/or delegating the exercise of our functions, thereby requiring us to exercise our functions as a sole data controller
3. Third parties may sometimes be contracted by us to provide services on our behalf. Our service specific privacy notices will detail when we contract out our services. Contractors are our data processors and only process personal information in line with our instructions

Personal Information may also be shared with the police, the Department for Work and Pensions, HMRC and other local authorities when we are either permitted to or are required to by law.

We are a signatory to the Kent and Medway Information Sharing Agreement. The types of purposes for which it is legitimate to share your personal information are set out in the Agreement. We may share the personal information of our service users where it is fair and lawful to do so and where the sharing takes place in a transparent manner. Our purposes for sharing information will be specified in our service specific privacy notices (see below).

We will not make your personal information available to companies for marketing purposes. We may share information with partners to achieve purposes that benefit you or the local community.

Should it be necessary to transfer special categories of personal information to a third country ie: a country or territory outside the UK, it will be transferred to a third country where:

• the transfer has to be necessary for any of the law enforcement purposes
• the transfer has to be based on either a finding of adequacy in respect of the third country, or where other appropriate safeguards are in place, or if not, that the transfer is for certain specified special circumstances
• the transfer is to a relevant authority, or is a ‘relevant international organisation’ ie: an international body that carries out functions for any of the law enforcement purposes

For the most part, it is expected that transfers will take place between ‘relevant authorities’, or relevant international organisations ie: to any (legal) person in the third country (or operating internationally) who has functions comparable to those of a ‘competent authority’ for the purposes of Part 3 of the DPA 2018. Sometimes, however, we may need to transfer personal information to a recipient that is not a relevant authority. Before we can do this, we must meet all four of these additional conditions:

1. The transfer is strictly necessary in a specific case, for the performance of a task by us, as provided by law for any of the law enforcement purposes

2. Your fundamental rights and freedoms do not override the public interest concerning the transfer

3. We consider that the transfer to a relevant authority in the third country would be ineffective, or inappropriate

4. We set out the specific purposes for which the data may be processed by the intended recipient and inform them of these

We will only keep your personal information for as long as we consider that it is necessary to be retained. Our Information Asset Registers list our retention periods. We will review our Information Asset Registers from time to time and therefore the time periods specified in them may change. Once personal information is no longer needed it will be deleted or destroyed confidentially.

The right to be informed

We are required to supply you with information about the processing of your personal information through notices such as this one.

The right to access personal information that we hold about you

You have the right to obtain from us confirmation that your personal information is being processed and access to your personal information. This is so that you are aware of and can verify the lawfulness of processing. There is generally no charge for this. We will provide your personal information without delay and generally within one month of the receipt of your request.

The right to rectification of your personal information

You have the right to have any personal information which we hold about you rectified if it is inaccurate or incomplete. We will generally deal with your request within one month.

The right to erasure of your personal information (sometimes called the ‘right to be forgotten’).

There are some specific circumstances where the right to erasure does not apply and we can refuse to deal with a request for example, where we are under a legal obligation to process your personal information in order to perform a task in the public interest.

You have the right to have personal information erased and to prevent processing in specific circumstances:

• Where the personal information is no longer necessary in relation to the purpose for which it was originally collected/processed
• When you withdraw consent
• When you object to the processing and there is no overriding legitimate interest for continuing the processing
• The personal information was unlawfully processed (ie: otherwise in breach of the GDPR)
• The personal information has to be erased in order to comply with a legal obligation

The right to restrict processing of your personal information

You have the right to restrict processing of your personal information in certain circumstances. Where processing is restricted, we are permitted to store your personal information but we may not process it further. We can retain just enough information about you to ensure that the restriction is respected in future.

The right to restrict arises in the following cases:

• Where you contest the accuracy of your personal information, we may restrict the processing until we have verified the accuracy of the personal information
• Where you have objected to the processing (where it was necessary for the performance of a public interest task), and we are considering whether our legitimate grounds override yours
• When processing is unlawful and you have opposed erasure and requested restriction instead
• If we no longer need your personal information but you require the personal information to establish, exercise or defend a legal claim

The right to information portability

You have the right to obtain from us and reuse your personal information for your own purposes where you have provided the information to us yourself, where we process the information by automated means and where our basis for processing is based on consent or contract. Where this right applies, we will provide you with your personal information in a structured, commonly used and machine readable form.

The right to object

You have a right to object to:

• processing based on the performance of a task in the public interest/exercise of official authority (including profiling);
• direct marketing (including profiling); and
• processing for purposes of scientific/historical research and statistics

Where the objection is to processing your personal information for direct marketing purposes, we must stop processing your personal information when we receive your objection.

Where the objection is to processing your personal information for the performance of a public interest task, we must stop processing your personal information unless we can demonstrate compelling legitimate grounds for the processing which override your interests, or, the processing is for the establishment, exercise or defence of legal claims.

Where the objection is to processing your personal data for research purposes, we do not have to comply with your objection where the processing of your personal information is necessary for the performance of a public interest task.

Rights related to automated decision making including profiling

Where we use automated decision making including profiling, the service specific privacy notice (see below)will explain the logic involved, the significance and the potential consequences for you.

Where the legal basis for processing your personal information is consent, you have the right to withdraw that consent at any time by notifying us. Please contact the Data Protection Officer and tell us which service you are using so that we can deal with your request.

If you withdraw your consent, it may not be possible to continue to provide you with that service.

If you wish to complain about how we are processing your personal information, please contact Customer Services Online, Dartford Borough Council, Civic Centre, Home Gardens, Dartford Kent DA1 1DR

You also have the right to complain to the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF: Telephone: 0303 123 1113 or 01625 545745: Website: https://ico.org.uk

There are occasions when you must provide personal information. Where such an obligation exists either as a statutory or contractual requirement, or a requirement necessary to enter into a contract the service specific privacy notices will tell you and explain the possible consequences of failure to do so.

Where we intend to process your personal information for a purpose other than that for which the personal data was collected, we will provide you with information on that other purpose before doing so.

Sometimes we hold information about you which you have not provided to us. Where this is the case we will tell you in the service specific privacy notice. We will tell you the source of the information unless it is not possible to do so. If the specific source is not named then information will be provided about the nature of the sources (ie: publicly/privately held sources) and the types of organisation/industry/sector.