Privacy notice: Facilities management post room

Who is the data controller

Oxfordshire County Council is the data controller for the data we collect about you as an individual.

You may contact our Data Protection Officer:

Information Services
Oxfordshire County Council
County Hall
New Road
Oxford
OX1 1ND

Our Data Protection Officer can be contacted on dataprotectionofficer@oxfordshire.gov.uk or 01865 792422.

What information do we collect

A GDPR-compliant hybrid mail solution to process and deliver our mail.

We will collect personal data about you.

This information will include:

• Name
• Contact details
• Personal identifiers (stated in FM privacy notice)

Why do we process personal data

We process your data under Article 6 of the UK-GDPR, adhering to the principles outlined in Article 5, which include lawful, fair, and transparent processing, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability.

The lawful basis for processing your data in accordance with legislation is:

Consent

We process your personal data based on your explicit consent. This means that you have given clear permission for us to process your data for one or more specific purposes. You have the right to withdraw your consent at any time, and we will stop processing your data unless we have another lawful basis to do so.

Legal obligations

We process your personal data to comply with our legal obligations. This means that we are required by law to process certain data. For example, we may need to process your data to comply with tax laws, employment laws, or other regulatory requirements.

Legitimate interests

We process your personal data based on our legitimate interests or those of a third party, provided that these interests are not overridden by your rights and interests. This includes processing necessary for the purposes of our legitimate business activities. For example, we might process your data to improve our services or to prevent fraud.

Who we share your personal data with

We may share relevant personal data with various entities to fulfil our obligations and provide services effectively. We will not share your personal data unless it is legally necessary or is essential to carry out our stated purposes. 

How do we protect your personal data 

At Oxfordshire County Council (OCC), we prioritise the security of your personal data. We employ a range of technical measures such as encryption and access controls to safeguard your data from unauthorised access. Additionally, our organisational measures include regular training for all employees to ensure they understand their responsibilities in protecting your data. Our physical security measures, such as secure facilities and secure disposal methods, further ensure that your data is always protected.

Where we use any AI based tools to help with admin functions they do not make decisions and do not process your data in a way not compatible with legislation.

How long do we keep your data for

Information provided to us to deliver Hybrid Mail solution will hold your data for secure post room areas for 20 working days until placing mail in confidential waste, where this is pre-agreed with teams. 

Once the data is no longer needed, it will be securely deleted to ensure your privacy is protected.

Your rights

Under data legislation (The UK General Data Protection Regulation and the Data Protection Act 2018) you have certain data subject rights to:

• be informed via Privacy Notices such as this.
• withdraw your consent if we are relying on your consent to process your data.
• access the personal information the council holds about you, by making a data subject request to the council, with valid identification and where necessary authority for children or other persons.
• rectification, to correct inaccurate or incomplete data.
• erasure, to delete your personal data unless there is a legal obligation to process your personal information.
• restrict processing, to reduce the information processed about you or prevent certain processing in future.
• data portability, to have your personal data in a structured, commonly used, machine-readable form when asked.
• object, to your personal data being used for profiling, direct marketing or research purposes, or any automated decision-making or profiling, to reduce the risk that a potentially damaging decision is taken without human intervention.

For more information about your rights and about how the Council processes information, please see our corporate privacy notice and access to information.

You can also complete the online complaints form on our website.

You also have the right to appeal to the Information Commissioner’s Office which is the UK regulatory authority for data protection issues:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

www.ico.org.uk