Encompass LATC LTD is committed to protecting and respecting your privacy. Through this privacy notice we have sought to be as transparent as possible to fully explain how your personal information is held and processed. This notice explains how we collect, use and share your information and how we keep it and how we keep it secure.
This privacy notice also explains when and why we collect personal information about people who engage or come into contact with us, whether via applying or receiving the services we provide on behalf of the London Borough of Sutton, receiving services that we provide independently of the London Borough of Sutton or visiting our websites.
Upon visiting our websites we will use third party service providers to collect technical information from your device, including standard internet log information such as the Internet Protocol (IP) address, your browser type and version, and certain page interaction information. In addition to this privacy notice some services have their own dedicated privacy notice to tell people in more detail how they use your information and the legal basis for using the information.
Encompass may collect various types of personal data about individuals depending on the services your receive and your contact with us. We only collect personal data that is absolutely necessary and any information we collect about you will be in accordance with data protection laws and other statutory obligations we are bound to follow.
From May 2018, genetic data and biometric data is treated as sensitive personal data. We may also record and monitor telephone calls to our contact centre for quality and training purposes.
We need your personal data in order to provide you with services that you apply for or receive from us and also where we are required to use information in order to meet our statutory obligations. We will only collect personal data that is absolutely necessary and any information we collect about you will be strictly in accordance with the data protection law and other statutory obligations which we are bound by.
In addition to providing the services above, you personal information is also processed for these additional purposes:
You will be advised of any further additional purposes or uses at the time the information is collected or used.
Encompass must have a lawful basis for processing your information. In most cases the information will be collected and used where we have statutory obligations to collect use or share your information; in those instances we have a public interest basis for processing your information. In some instances the services we provide are optional which means that Encompass will only provide the service if the customer has requested the service or the customer consents to the service. In that instance, consenting to the service does not necessarily mean that the lawful basis for processing your information is consent; Encompass may rely on the public interest basis where it has specific powers to provide the service.
Where your consent is required to process your information we will seek your consent. However, where your consent is not required to process your information, for example where Encompass has a lawful basis for processing your information, your consent will not be sought. Where we need to disclose sensitive or confidential information such as medical details to other partners we will do so only with your prior explicit consent unless we are legally entitled to share the data.
Encompass may also process your information where processing is necessary for the performance of a contract and where processing is necessary to protect your vital interest or the vital interest of another person. Encompass may also process your information where we are obliged to process your information to comply with the law.
Where we have statutory authority to collect and process your personal information for the provision of our services, your consent is not required to process your information. Where the service is optional, we will not process your information until you have consented to receive the service. Once we have your consent for the service, your information will be processed under our statutory authority to provide the service.
Upon visiting our website, cookies are used to collect information about website usage.
Encompass always acts upon your choices around what type of communications you want to receive and how you want to receive them. Where you have signed up for one of our newsletters, we use email newsletters to inform you of what we're doing, news and events.
Tools may be used to help us improve the effectiveness of our communications with you, including tracking whether the emails we send are opened and which links are clicked within a message. This helps us to improve and refine future email marketing around our campaigns and make sure all our emails are relevant and useful as possible.
You have a choice about whether or not you wish to receive information from us. If though you no longer want to receive our e-newsletters, then you can do this by clicking the unsubscribe link on marketing emails we send.
Encompass LATC LTD has statutory obligations to collect, process and share personal information without consent, with our partners such as the NHS, housing associations, schools, central government, such as DWP, HMRC, Home Office, Dept. Of Education, Dept. of Health, other councils and law enforcement agencies such as the Police and the Crown prosecution service, for the following purposes:
To ensure that Encompass LATC provides you with an efficient and effective service we will sometimes need to share your information between teams within the council. We may also share your information with our partners to deliver national government programmes and initiatives such as the Troubled Families programme, or improving services we deliver, or provide the services you agreed to receive.
In most cases this will be done where there is a lawful basis under the conditions set out in data protect laws. We may also share your information with third party service providers working on our behalf for the purposes of completing tasks and providing services to you on our behalf (for example; domiciliary care providers). However, when we use third party service providers, we disclose only the personal information that is necessary to deliver the service and we have a contract in place that requires them to keep your information secure, as required by the Data Protection Act 1998 and General Data Protection Regulation 2016 (GDPR), and not to use it for any other purposes.
We will never use or share your personal information to third parties for marketing purposes without your permission.
We review our retention periods of the information we hold about you on a regular basis. We are legally required to hold some types of information to fulfil our statutory obligations. We will hold your personal information on our systems for as long as it is necessary for the relevant activity or service that we provide to you, or as required by law.
We will retain your information for the period in which your information is being used for service provision or for our wider functions including debt collection. Where we have statutory authority to process your information; your right to be forgotten does not apply to our functions and services
Encompass uses Google Cloud Platform in the provision of its services and wider functions. This means that your personal and sensitive data is stored and processed on servers outside of the European Economic Area (EEA). Google has certification under the EU-U.S. and Swiss-U.S Privacy Shield Frameworks; this means that there is an adequate level of security for data processing and therefore your data is being processed lawfully.
We are working on how to improve how we provides services and how to make our record keeping more relevant and efficient.
We are implementing systems which record details of name, address, date of birth, gender, contact details (telephone/e-mail) and information which can be used to confirm your identity.
These systems may be used to act as an index to other Encompass and Council systems where appropriate and be able to feed information into them, including changes to your address and/or contact details as and when you inform us.
As an entity wholly owned by and working on behalf of The London Borough of Sutton we, along with other agencies such as schools and early years settings, process information about children and young people in order to administer service provision. In doing so we must comply with the Data Protection Act (1998). This means (amongst other things) that the data held about children must only be used for specific purposes allowed by law.
Personal data identifies a living person and/or includes any expression of opinion about that person.
'Sensitive personal data' might include:
All personal data is processed in accordance with your rights under the Data Protection Act 1998. It lays down eight principles of good information handling which state that personal information should be:
We use electronic case management systems to store information about you. We may also have historical information on paper case files. We have security measures in place to safeguard the confidentiality of your records and prevent any unlawful access
to your personal data.
The information we hold helps us to decide the best way to help people. We need to keep this information to help plan and provide the correct services for you.
Where we do not directly provide the service, we may need to pass your personal data onto the people who provide the service. These providers are obliged to keep your details safe and secure, and use them only for social care or housing services.
After you have finished receiving services from us, we may keep the information we hold about you if it seems likely that you might need our services again, or we are requested by law to do so. We will not keep your records for longer than is necessary.
When you ask for help or advice from us, we collect information about your personal and family circumstances. Other people - for example members of your family, medical professionals or support agencies - might also give information. We keep notes of meetings and conversations with you and with other people. We hold electronic records of your assessments, housing register and applications or homelessness, care and support plans, reviews and any investigations that take place.
We will ensure that your personal data is treated as confidential where appropriate, is relevant, accurate and kept up to date.
Only those staff involved in providing the relevant service to you can see the information - this may include social workers, care managers, occupational therapists, mental health workers, administrative staff and some colleagues from other council services.
All our staff are required to abide by a strict code of conduct on confidentiality and information sharing. We emphasise the importance of sharing information at an early stage to ensure you get the service you require.
We may also share some information with other staff who do not work for us but are involved in providing support to you. This may include, for example, your GP or care provider.
n circumstances where the disclosure of personal data is necessary, our staff understand when, why and how to share information.
Under the Data Protection Act, you, as a 'data subjects', are entitled to have access within 40 days following a request to information we hold regarding your personal details.
Under the Act you are also entitled to:
These are called subject access requests and must be made in writing to us. There are some exemptions to disclosure of information to data subjects under the terms of the Act. The Data Protection Act does not give third parties rights of access to personal information about individuals still living.
To request a copy of this information you must make a subject access request in writing, either via email or a letter to:
To ensure that we can deal with your request as efficiently as possible you will need to include your current name and address, proof of identity (a copy of your driving licence, passport or two different utility bills that display your name and address), as much detail as possible regarding your request so that we can identify any information we may hold about you, this may include your previous name and address, date of birth and what service you were involved with.
Encompass LATC must respond within a month, which may be extended by a further two months if the request is complex and the service is free.
We must correct inaccurate or incomplete information. The right of erasure otherwise known as the fight to be forgotten came into effect in May 2018. You will have the right to have your information erased and to prevent processing unless we have a legal obligation to process your information.
From May you have the right to restrict the processing of your data in the limited circumstances provided in law. For example, where the accuracy of the data is contested or the processing is unlawful (and you have requested data restriction) or where the council no longer needs the data. Where those circumstances are present, we will quarantine your information so that it is only used for a more limited range of purposes permitted within the law, such as handling legal claims.
You can object to your information being used and Encompass LATC LTD will stop processing your information unless it can demonstrate that it has compelling grounds for continuing the processing, or that the processing is necessary in connection with its legal rights.
From May 2018 you have had the right to get personal data in a machine readable format where you have provided your personal data directly to the company and where the company is relying on consent or performance of a contract as the lawful basis for processing data.
In order to do this we collect, use and share Aggregated Data such as statistical or demographic data Aggregated Data may be derived from your personal data but is not considered personal data in law as this data does not directly or indirectly reveal your identity. For example, we may aggregate your Usage Data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this privacy notice.
You have rights in relation to automated decision making and profiling including the right to be told if your data is subject to automated decision making and profiling.
Profiling means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a person, to analyse or predict aspects concerning that person's economic and health situation, reliability, personal preferences and interests etc. Automated decision making means any processing that is carried out by automated means without any human review element in the decision-making. For example; carrying out credit checks searches to detect and reduce fraud.
We may use your information from the different services that you engage with to create a single view and profile of you, which will help us to better understand your specific needs and ensure we are providing the right and efficient services to you in accordance with your needs as well as ensure that we hold one accurate record of your basic personal data across all our council services; such as your name, DoB, address, email address, change in circumstances etc. Profiling will be carried out only when it is necessary in order to provide you with the service you have agreed to receive or where the council has a statutory obligation or where to the law allows. However, we will notify you where we would do this and where required we will seek your consent.
Any information held by Encompass LATC LTD about individuals is held securely and in compliance with the Data Protection Act 1998 and GDPR. Encompass is committed to protecting its service user's and customers personal data. We have put measures in place to ensure that our staff, service providers, partners and suppliers all look after your information in line with good practice and the law. These follow the rules and practices known as Information Governance (IG).
The information security measures we've put in place include:
If you suspect that there has been, or there is a risk of there being, a breach of the Data Protection Act in the way in which we or our partners or subcontractors handle personal information, then please contact us and ask for the Data Protection Officer. Encompass LATC LTD is however committed to using pseudonymised or anonymised information as much as is practical, and in many cases this will be the default position. Pseudonymisation is a procedure by which the most identifying fields within a data record are replaced by one or more artificial identifiers, or pseudonyms. There can be a single pseudonym for a collection of replaced fields or a pseudonym per replaced field. Anonymisation is the process of removing identifying particulars or details from (something, especially medical test results) for statistical or other purposes.
We will periodically review our privacy statement to reflect changes in our services and feedback from service users, as well as to comply with changes in the law.If you would like to know more information, then please contact us.
As a local authority trading company we provide many of our services on behalf of the London Borough of Sutton. However we also provide services independently. The way in which we use and share your information differs depending on which of ours services you are accessing. If you are accessing a service that we provide independently of the council we will not share your information with them without seeking your explicit consent.