Encompass LATC LTD is committed to protecting and respecting your privacy. Through this privacy notice we have sought to be as transparent as possible to fully explain how your personal information is held and processed. This notice explains how we collect, use and share your information, how we keep it and how we keep it secure. This privacy notice also explains when and why we collect personal information about people who engage or come into contact with us.
Upon visiting our websites we will use third party service providers to collect technical information from your device, including standard internet log information such as the Internet Protocol (IP) address, your browser type and version, and certain page interaction information.
Information collected about you
Encompass may collect various types of personal data about individuals depending on the services your receive and your contact with us. We only collect personal data that is absolutely necessary and any information we collect about you will be in accordance with data protection laws and other statutory obligations we are bound to follow.
The various types of personal data we collect include:
- contact details (including name, title, address, billing address, email address and telephone number)
- date of birth
- UK/EU/EAA residency details
- proof of identity
- national identifiers such as; NHS number and NI numbers
- information about your family
- IP address and information regarding what pages are accessed and when
- lifestyle, social and personal circumstances
- financial details for purposes of receiving or making payments
- employment details (when you apply for jobs)
- education records
- next of kin information
- transaction data: including the details of the products and services purchased and the date, time and location of sale and your purchasing activity
- housing information relating your council tenancy
- visual images, personal appearance and behaviour
- voice recording
- the services you receive
- technical data: including information we collect through your use of our websites and mobile apps, where you came to our website from and where you went when you left our website, how often you visit and use our websites and mobile apps, technical information about the devices you use to access our websites and mobile apps (including your device’s unique identifying codes (e.g. its “MAC” address), relevant IP address, operating system and version, web browser and version, and geographic location)
- marketing and communications data: including your preferences in receiving marketing from us, your communication preferences and information on what you view, click on and access in and through our marketing emails, text messages and push notifications
We may also record and monitor telephone calls to our contact centre for quality and training purposes.
We may also collect sensitive personal data that may include:
- physical or mental health details
- racial or ethnic origin
- sex life and sexual orientation
- trade union membership
- political affiliation and opinions
- religious or other beliefs of a similar nature
- criminal convictions and offences (including alleged)
- genetic and biometric data
Why we need your information
We need your personal data in order to provide you with services that you apply for or receive from us and also where we are required to use information in order to meet our statutory obligations. We will only collect personal data that is absolutely necessary and any information we collect about you will be strictly in accordance with the data protection law and other statutory obligations which we are bound by.
We process your information for the following services:
- housing needs and homelessness services
- adults social care services
- encompass innovate services
In addition to providing the services above, you personal information is also processed for these additional purposes:
- fulfil our legal duties and obligations (including safeguarding children)
- provide efficient and effective services
- help you access the right services
- collect debts
- prevent, detect and prosecute fraud, corruption or other crimes
- personalise repeat visits to our website
- deliver national government programmes and initiatives.
You will be advised of any further additional purposes or uses at the time the information is collected or used.
Who your information may be shared with
Encompass LATC LTD has statutory obligations to collect, process and share personal information without consent, with our partners such as the NHS, housing associations, schools, central government, such as DWP, HMRC, Home Office, Dept. Of Education, Dept. of Health, other councils and law enforcement agencies such as the Police and the Crown prosecution service, for the following purposes:
- health and wellbeing and public health
- safeguarding of vulnerable adults and children
- the prevention and detection of crime
- the assessment of any tax or duty
- collection of debt
- if we are required to do so by any court or law
- prevention of fraud
- the national fraud initiative
- protect you or other individuals from serious harm
- protect public funds
- public safety and law enforcement
- criminal or civil prosecution of offenders
- national security
To ensure that Encompass LATC provides you with an efficient and effective service we will sometimes need to share your information between teams within the council. We may also share your information with our partners to deliver national government programmes and initiatives, or improving services we deliver, or provide the services you agreed to receive.
We may share with:
- NHS (GP’s, Hospital, Mental Health, CCG’s etc.)
- voluntary sectors
- central government
- other councils
- housing associations
In most cases this will be done where there is a lawful basis under the conditions set out in data protection laws. We may also share your information with third party service providers working on our behalf for the purposes of completing tasks and providing services to you on our behalf (for example; domiciliary care providers). However, when we use third party service providers, we disclose only the personal information that is necessary to deliver the service and we have a contract in place that requires them to keep your information secure, as required by the Data Protection Act 2018 and UK General Data Protection Regulation (UK GDPR) and not to use it for any other purposes.
We will never use or share your personal information to third parties for marketing purposes without your permission.
If you are receiving a service from us that we provide on behalf of the London Borough of Sutton, we may share some of your information, for example your name and address, internally with other departments in the Council if this:
- helps you to access services more easily
- promotes the more efficient and cost effective delivery of council services
- helps recover monies owed to the council
Lawful basis to process your information
Encompass must have a lawful basis for processing your information. In most cases the information will be collected and used where we have statutory obligations to collect, use or share your information; in those instances we have a public interest basis for processing your information. In some instances the services we provide are optional which means that Encompass will only provide the service if the customer has requested the service or the customer consents to the service. In that instance, consenting to the service does not necessarily mean that the lawful basis for processing your information is consent; Encompass may rely on the public interest basis where it has specific powers to provide the service.
Where your consent is required to process your information we will seek your consent. However, where your consent is not required to process your information, for example where Encompass has a lawful basis for processing your information, your consent will not be sought. Where we need to disclose sensitive or confidential information such as medical details to other partners, we will do so only with your prior explicit consent unless we are legally entitled to share the data.
Encompass may also process your information where processing is necessary for the performance of a contract and where processing is necessary to protect your vital interest or the vital interest of another person. Encompass may also process your information where we are obliged to process your information to comply with the law.
Where we have statutory authority to collect and process your personal information for the provision of our services, your consent is not required to process your information. Where the service is optional, we will not process your information until you have consented to receive the service. Once we have your consent for the service, your information will be processed under our statutory authority to provide the service.
How long we keep your information
We review our retention periods of the information we hold about you on a regular basis. We are legally required to hold some types of information to fulfil our statutory obligations. We will hold your personal information on our systems for as long as it is necessary for the relevant activity or service that we provide to you, or as required by law.
We will retain your information for the period in which your information is being used for service provision or for our wider functions including debt collection. Where we have statutory authority to process your information; your right to be forgotten does not apply to our functions and services
Who can see the information held about me?
Only those staff involved in providing the relevant service to you can see the information – this may include social workers, housing officers, assessment officers, occupational therapists, mental health workers, administrative staff and some colleagues from other council services.
All our staff are required to abide by a strict code of conduct on confidentiality and information sharing. We emphasise the importance of sharing information at an early stage to ensure you get the service you require.
We may also share some information with other staff who do not work for us but are involved in providing support to you. This may include, for example, your GP or care provider.
In circumstances where the disclosure of personal data is necessary, our staff understand when, why and how to share information.
- asking for your consent at the outset, and recognising when consent may not be required
- only sharing information with those who need to know in order to provide you with good quality care or housing services
- sharing the minimum necessary to ensure good quality care
- sharing information for legal or contractual reasons or if in the public interest or to reduce risk of significant harm
Upon visiting our website, cookies are used to collect information about website usage.
Cookies are also set when you:
- click on social networking buttons in our pages such as facebook and twitter
- watch videos
- register for services
- take part in online surveys
Marketing and E-Newsletters
Encompass always acts upon your choices around what type of communications you want to receive and how you want to receive them. Where you have signed up for one of our newsletters, we use email newsletters to inform you of what we’re doing, news and events.
Tools may be used to help us improve the effectiveness of our communications with you, including tracking whether the emails we send are opened and which links are clicked within a message. This helps us to improve and refine future email marketing around our campaigns and make sure all our emails are relevant and useful as possible.
You have a choice about whether or not you wish to receive information from us. If though you no longer want to receive our e-newsletters, then you can do this by clicking the unsubscribe link on marketing emails we send.
Details of transfers to third country and safeguards
Encompass uses Google Cloud Platform in the provision of its services and wider functions. This means that your personal and sensitive data is stored and processed on servers outside of the European Economic Area (EEA). Google has certification under the EU-U.S. and Swiss-U.S Privacy Shield Frameworks; this means that there is an adequate level of security for data processing and therefore your data is being processed lawfully.
Children and young people
As an entity wholly owned by and working on behalf of Sutton Council, we, along with other agencies such as schools and early years settings, process information about children and young people in order to administer service provision. In doing so we must comply with the Data Protection Act (2018). This means (amongst other things) that the data held about children must only be used for specific purposes allowed by law.
- the right to be informed
- the right of access
- the right to rectification
- the right to erasure
- the right to restrict processing
- the right to data portability
- the right to object
- rights in relation to automated decision making and profiling
- the right to lodge a complaint with the Information Commissioner’s Office (ICO)
Right of Access (Subject Access Request)
Under UK GDPR and the Data Protection Act, you, as a ‘data subjects’, are entitled to have access without undue delay and within one month following a request to information we hold regarding your personal details.
Under the Act you are also entitled to:
- a description of the data being processed
- the purposes for which it is being processed
- a description of the recipients
- the source of the data
- where any decision is taken based solely on an automated process.
These are called subject access requests (SAR’s). There are some exemptions to disclosure of information to data subjects under the terms of the Act. The Data Protection Act does not give third parties rights of access to personal information about individuals still living.
To request a copy of this information you must make a subject access request in writing, either via email or a letter to:
Data Protection Team
Encompass LATC LTD
1 Carshalton Road
Alternatively you can make the request verbally to a member of Encompass staff. Regardless of how you tell us, to ensure that we can deal with your request as efficiently as possible you will need to include your current name and address, proof of identity (a copy of your driving licence, passport or two different utility bills that display your name and address), as much detail as possible regarding your request so that we can identify any information we may hold about you, this may include your previous name and address, date of birth and what service you were involved with.
Encompass LATC must respond within a month, which may be extended by a further two months if the request is complex and the service is nornally free. If we are not the Controller of the data you have requested we will assist you in directing your enquiry to the relevant organisation.
We will send you a copy of all the information we hold on you. Any third party information will be redacted unless we have consent from the third party to provide it.
Some information may fall under an exemption from GDPR regulations. We will justify and document our reasons for relying on any exemption.
We operate a Data Retention Policy to ensure that information is not held for longer than necessary. Your subject access request and paperwork will be kept for three years and then securely destroyed.
We may analyse your personal information to improve services and for the following purposes:
- undertake statutory functions efficiently and effectively
- service planning by understanding your needs to provide the services that you request
- understanding what we can do for you and inform you of other relevant services and benefits
- help us to build up a picture of how we are performing at delivering services to you and what services the people of the borough need
- analysis of costs and spend of services we provide so that we can to ensure better and efficient use of public funds
In order to do this we collect, use and share Aggregated Data such as statistical or demographic data. Aggregated Data may be derived from your personal data but is not considered personal data in law as this data does not directly or indirectly reveal your identity. For example, we may aggregate your Usage Data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this privacy notice.
Information security breach
If you suspect that there has been, or there is a risk of there being, a breach of UK GDPR or the Data Protection Act in the way in which we or our partners or subcontractors handle personal information, then please contact us and ask for the Data Protection Officer. Encompass LATC LTD is however committed to using pseudonymised or anonymised information as much as is practical, and in many cases this will be the default position. Pseudonymisation is a procedure by which the most identifying fields within a data record are replaced by one or more artificial identifiers, or pseudonyms. There can be a single pseudonym for a collection of replaced fields or a pseudonym per replaced field. Anonymisation is the process of removing identifying particulars or details from (something, especially medical test results) for statistical or other purposes.
Changes to our Privacy Notice
Any changes we make to this Privacy Notice will be posted on this website. Please check here frequently to see any updates or changes to our Privacy Notice.
The Services we provide
As a local authority trading company we provide many of our services on behalf of the London Borough of Sutton. However we also provide services independently. The way in which we use and share your information differs depending on which of our services you are accessing. If you are accessing a service that we provide independently of the council we will not share your information with them without seeking your explicit consent.
Information Commissioner's Office
The Information Commissioner’s Office (ICO) is the UK’s independent body set up to uphold information rights. If you would like to know more about your rights under the Data Protection law, and what you should expect from us, visit the the ICO website at www.ico.org.uk
If you have any concerns regarding our privacy practices or about exercising your Data Protection rights, or you are dissatisfied with how Encompass have responded to a complaint about the way in which we have processed your personal information, you have the right to lodge a complaint to the ICO at the following address:
Information Commissioner’s Office