Privacy Notice for County Print and Oxfordshire Employment Service

What our service does

County Print Finishers is a supported business that provides employment opportunities for individuals with disabilities, offering services including print, mail, rebranding, and confidential waste shredding. Oxfordshire Employment Service supports people with disabilities in finding and maintaining employment, which involves handling personal data to provide tailored support.

Who is the Data Controller

Oxfordshire County Council is the Data Controller for the data we collect about you as an individual.

You may contact the council’s Data Protection Officer as follows:
Information Services
Oxfordshire County Council
County Hall
New Road
Oxford
OX1 1ND
Email: dataprotectionofficer@oxfordshire.gov.uk
Tel: 01865 792422

What information do we collect

We collect personal data, including:

• Name, address, date of birth, contact details
• Employment history, education history, support needs, and disability information
• Business delivery addresses or agreed delivery addresses that are not a business.
• For Oxfordshire Employment Service: names, addresses, dates of birth, EHCP plans, care support plans. Criminal history and health information. We may also record your financial information if we assist you with benefit claims to support your employment.
• For County Print: job tickets, delivery addresses, and minimal personal data related to specific jobs, such as name, address and contact details.
• Hybrid mail includes. Names, addresses, dates of birth, EHCP plans, care plans, criminals' history, fines, and other health information. 

We may also collect special category data, such as:

• Health and disability information
• Criminal records (for vetting purposes, e.g., enhanced DBS checks for staff involved in confidential waste shredding)

Why do we process personal data

We process your data in accordance with Article 6 of the UK GDPR, adhering to the principles outlined in Article 5.

The lawful basis for processing your data is:

• Public Task: To perform a task carried out in the public interest or in the exercise of official authority.
• Legal Obligations: To comply with legal requirements, such as vetting for confidential waste handling.
• Consent: Where explicit consent is required, for example, for processing certain special category data.

Special category data is processed under Article 9 of the UK-GDPR:

• Processing is necessary for employment and social protection law.
• Processing is necessary for reasons of substantial public interest.
• Processing is necessary for the provision of health or social care.

Criminal conviction data:

Where applicable, data relating to criminal convictions is processed to assess suitability for certain roles (e.g., confidential waste handling), under Article 10 of the UK-GDPR and Schedule 1 of the Data Protection Act 2018.

Where Oxfordshire Employment supports you to find work, we are legally required to share information about certain convictions with employers. 

Who we share your personal data with

We may share your data with:

• Contracted providers (e.g., external print or rebranding companies, vetting services such as SVS)
• Employers, training providers, support agencies, and other relevant organisations to support employment and training opportunities
• Regulatory bodies or authorities where legally required such as the DWP. 

All sharing is done via secure methods (e.g., secure email for vetting) and only where necessary.

How do we protect your personal data

At Oxfordshire County Council, we prioritise the security of your personal data. We employ technical measures such as encryption and access controls, regular staff training, and secure disposal methods. Where AI-based tools are used for admin functions, they do not make decisions or process your data in a way not compatible with legislation.

How long do we keep your data for

Personal data is retained for as long as necessary to fulfil the purposes for which it was collected, including satisfying legal, accounting, or reporting requirements. Specific retention periods are referenced in the relevant DPIA and statutory requirements. Once data is no longer needed, it is securely deleted.

Your rights

Under data legislation (The UK General Data Protection Regulation and the Data Protection Act 2018) you have certain data subject rights to:

• be informed via Privacy Notices such as this.
• withdraw your consent if we are relying on your consent to process your data.
• access the personal information the council holds about you, by making a data subject request to the council, with valid identification and where necessary authority for children or other persons.
• rectification, to correct inaccurate or incomplete data.
• erasure, to delete your personal data unless there is a legal obligation to process your personal information.
• restrict processing, to reduce the information processed about you or prevent certain processing in future.
• data portability, to have your personal data in a structured, commonly used, machine-readable form when asked.
• object, to your personal data being used for profiling, direct marketing or research purposes, or any automated decision-making or profiling, to reduce the risk that a potentially damaging decision is taken without human intervention.

For more information about your rights and about how the Council processes information, please see our corporate privacy notice and access to information.

You can also complete the online complaints form on our website.

You also have the right to appeal to the Information Commissioner’s Office which is the UK regulatory authority for data protection issues:

Information Commissioner’s Office
Wycliffe House
Water Lane 
Wilmslow 
Cheshire
SK9 5AF 

www.ico.org.uk 

0303 123 1113.