This Privacy Statement was last reviewed and updated in May 2018 to take into account new data protection laws coming into force across the European Union, particularly the General Data Protection Regulation (also known as the GDPR). We are committed to protecting your privacy and we comply with the GDPR and the UK data protection rules (together with associated guidance) (“Data Protection Laws“).
This Privacy Statement describes the information we may collect from you and explains how we use, store and share your personal data and supplements any fair processing notice provided to you, including the Personal Information Charter.
This website (“Website“) is run by the Department for Digital, Culture, Media & Sport (“we” and “us“, “DCMS“).
Any changes to this Privacy Statement in the future will be posted on this page, and where appropriate, notified to you by email. We will also post a notice on the Website landing page. Please check back frequently to see any updates or changes to this Privacy Statement.
Where do we get your information?
Beneficiaries: We collect your information from your supplier, who has registered with us as part of the scheme.
Supplier representative: We collect your information from your employer.
What information do we receive about you?
We receive information such as your name, address and postcode.
Why do we need this information?
To operate and administer the scheme effectively, verify the use of vouchers, determining eligibility for the scheme and to report on the effectiveness of the scheme to local and central government.
Who do we share the information with?
Registered suppliers, relevant local bodies, other government departments and local and central government.
Otherwise, we will only disclose your information to:
(a) our professional advisors (including without limitation tax, legal or other corporate advisors who provide professional services to DCMS)
(b) regulators (including Ofcom), law enforcement or fraud prevention agencies, courts, the police and any other authorised bodies, for the purposes of investigating any actual or suspected criminal activity or other regulatory, legal, commercial or public matters etc.
The use of your personal information by third parties under (b) will be governed by such third parties’ privacy statements and policies, which you should familiarise yourself with. These parties are also “controllers”, which means they have independent obligations under the Data Protection Laws to protect your personal data and provide you with information as to how they process it (subject to certain exemptions). We also have contracts in place with these third parties to safeguard the personal information we share with them.
(c) other third-party suppliers for business administration or IT purposes
The use of your personal information by third parties under (c) is governed by this policy. We appoint these third parties on a “processor” basis, which means they are subject to contractual and legal obligations to protect your personal information in line with the Data Protection Laws, this policy and contractual obligations we have put in place with these third parties to safeguard the information we share.
(d) analytics or search engines, including Google that enable us to optimise and improve your website experience. For more information, please see our cookies policy.
On what basis can we process your information?
We process your information on the basis that it is necessary for the performance of a task (i.e. the operation of the scheme) carried out in the public interest. Your personal data may be processed for statistical analysis that may be published on an anonymous basis, for example in the form of location maps (or other types of graphical or literary representation).
DCMS has put in place various security measures in accordance with up-to-date industry procedures as set out in this Privacy Statement to keep personal data as safe and secure as possible and to protect from unauthorised or unlawful processing and accidental loss, destruction or damage.
We have in place appropriate policies, rules and technical and organisational measures to protect your personal information from unauthorised or unlawful processing, and against accidental loss, destruction of or damage to personal information.
Supplier representatives: You are responsible for protecting your password and username when logging into the portal and must not share it with, or disclose it, to anyone.
HOW LONG WE KEEP YOUR INFORMATION
We will typically keep your personal data for ten (10) years (as we are required to keep records about who benefits from vouchers for this period).
You have a number of rights under data protection laws in relation to the way we process your personal data. These are set out below. You may contact us to exercise any of these rights, and we will respond to any request received from you promptly and in compliance with data protection laws.
- Right 1 – A right to access personal data held by us about you.
- Right 2 – A right to require us to rectify any inaccurate personal data held by us about you.
- Right 3 – A right to require us to erase personal data held by us about you. This right will only apply where (for example): we no longer need to use the personal data to achieve the purpose we collected it for; or where you object to the way we process your data (in line with Right 5 below).
- Right 4 – In certain circumstances, a right to restrict our processing of personal data held by us about you. This right will only apply where (for example): you dispute the accuracy of the personal data held by us; or where you would have the right to require us to erase the personal data but would prefer that our processing is restricted instead; or where we no longer need to use the personal data to achieve the purpose we collected it for, but you require the data for the purposes of dealing with legal claims.
- Right 5 – A right to object to our processing of personal data held by us about you where the processing of such data is necessary in the public interest, unless we are able to demonstrate, on balance, legitimate grounds for continuing to process personal data which override your rights or which are for the establishment, exercise or defence of legal claims.
We encourage you to contact us first if you have any queries, comments or concerns about the way we handle your data. However, if you are not satisfied with our handling of any request by you in relation to your rights or concerns, you also have the right to make a complaint to our lead supervisory authority, which is the UK’s Information Commissioner’s Office. Their address is: First Contact Team, Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, SK9 5AF
For further information from us on data protection and privacy or any requests concerning your personal information please contact us.