Purpose of processing
We take a One Council approach. Some of our statutory functions are governed by their own regulatory regime for complaints (e.g. a specialist ombudsman) but our corporate policy remains the same: we treat dealing with enquiries, comments, complaints and compliments as an opportunity to learn how to improve our services.
We are committed to protecting your personal data, and ensuring it is used fairly, lawfully and in line with our customer commitments. Information you provide to us will be used in accordance with UK GDPR and other data protection legislation.
The personal information we use
Most of the information we process when dealing with customer contacts comes straight from you. However, we can collect information from a range of other individuals and organisations, if this is necessary for resolution of the issues you raise.
We collect and process the following types of data:
- Your name and contact details
- Other personal information such as your date of birth or family circumstances
- Special category personal data related to your communication, such as information on your health, disabilities, racial/ethnic origin or political opinions.
We make audio recordings of all calls to Call Derbyshire. If you do not wish to be recorded, please mention this to the customer care assistant.
Lawful basis of processing
The information provided will only be used for investigating, resolving and following up on your communication. If there are lessons to be learned from the outcome, we will share these internally to improve our services, without including anything that identifies you as an individual.
The lawful basis for processing is legal obligation, arising primarily from information law. For instance:
- The Data Protection Act 2018 requires us to have a data protection complaints procedure. This means we must use personal data as part of a record showing who made the complaint and what it concerns;
- The Freedom of Information Act 2000 requires us to respond to requests for information within a statutory timeframe. We must use personal data as part of a record showing when an enquiry was received and when we replied.
Our legal condition for processing any special category data contained in your communication is substantial public interest. We process this data because it is necessary to carry out our statutory functions.
If responding to your communication necessarily involves processing criminal offence data, we do this to prevent or detect criminal acts, or another condition from the Data Protection Act 2018, Schedule 1.
These are not the only legal obligations. Some are service-specific. To find out about a particular service, check its privacy notice.
Keeping your information safe
To meet our commitment to protecting your personal data we have data protection policies and procedures in place to ensure that it is safeguarded.
We carry out checks on all third parties we use, and have contracts in place with them which detail data protection obligations they must follow.
How long we keep your information
We apply a six-month retention period to incoming messages, replies, and audio recordings of calls to Call Derbyshire. This short retention period allows Call Derbyshire to pass the information (but not usually the audio recording) to the relevant service for resolution. Information transferred to that service is kept in line with our other records retention schedules. The default 6+ Rule applies unless your communication is part of a longer-term matter where we have a lawful reason to retain it. For instance, if Call Derbyshire is the first contact point for your adult social care enquiry, the information you provide is added to that person’s case file.
Sharing your information
Sometimes we are required to pass personal data on to other organisations. For instance, if you raised a child safeguarding concern, we may pass this information to law enforcement agencies. We will only share your personal data if necessary to deal with your communication. When sharing information, we do so in line with data protection legislation and information sharing agreements with our partners.
To process your personal data, we use third party software providers such as Microsoft. We carry out checks on all data processors we use, and have contracts in place with them which detail data protection obligations they must follow.
Your rights
You have the following rights, subject to lawful exemptions:
- The right to be informed about how we use your data
- The right of access to your data
- The right to rectification of your data if it is factually incorrect
- The right to object to processing
You can find further information on your rights, and how to make requests under those rights.
For more detailed advice on your rights visit the Information Commissioner's Office website.