This privacy notice gives you information on how Cyngor Gwynedd’s (CG) Telecare Service collects, processes and shares personal data. In accordance with the retained EU law version of the General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018, this privacy notice sets out what how CG manages data collected through the delivery of the telecare service. This may include but is not limited to; customer personal data, and any personal information relating to key holders, family, friends and carers, on call officers or contractors.
The controller of your personal data is Conwy County Borough Council (CCBC). In some circumstances, your personal data may be jointly controlled by CCBC and another local authority or service commissioner.
Provided by CCBC, Galw Gofal is a call monitoring service based in North Wales providing bilingual 24/7 support for the delivery of health and social care to help protect vulnerable people in their own homes or in the workplace and providing safety, security and continued independence.
The personal data we collect about you
Personal data means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data). We may collect, use, store and transfer different kinds of personal data about you as follows:
- Identity Data includes title, first name, last name, marital status and gender of data subjects, emergency contacts, out of hours emergency contacts, anyone else living in the same property as the service user, the service user’s landlord (where such landlord has commissioned the Services on behalf of a service user), domiciliary care agencies or support workers to a service user, named contractors, duty officers and managers provided by any joint controller which has commissioned the Services on behalf of any service user(s); if age, address, and telephone numbers;
- Contact Data includes address, telephone number and email address of data subjects, emergency contacts, out of hours emergency contacts, anyone else living in the same property as the service user, the service user’s landlord (where such landlord has commissioned the Services on behalf of a service user), domiciliary care agencies or support workers to a service user named contractors, duty officers and managers provided by any joint controller which has commissioned the Services on behalf of any service user(s);
- Profile Data includes unique equipment reference number assigned to the telecare equipment installed in a service user’s home, unique ‘WCCIS’ Social Care database reference number allocated to a service user;
- Usage Data means satisfaction information and details of complaints from or relating to service users.
We may collect, use, store and transfer the following different kinds of special category personal data about you as follows:
- racial or ethnic origin;
- religious or philosophical beliefs;
- data concerning your physical or mental health or condition, medication or other treatment, welfare concerns, physical description or photograph; and
- sex or sexual orientation.
We may also collect, use and share aggregated data such as statistical or demographic data for any purpose. Aggregated data could be derived from your personal data but is not considered personal data in law as this data will not directly or indirectly reveal your identity. For example, we may aggregate your usage data to calculate the percentage of service users making emergency calls. However, if we combine or connect aggregated data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this service privacy notice.
How is your personal data collected?
We use different methods to collect data from and about you including through:
- direct interactions. You may give us your identity and contact data by filling in forms or by corresponding with us by post, phone, email or otherwise. This includes personal data you provide when you register as a service user, give us feedback or contact us;
- automated technologies or interactions. As you interact with our Services we will automatically collect technical data about your equipment connected with our delivery of the Services. We collect this personal data by using server logs and other similar technologies;
- third parties. We will receive personal data about you from various third parties including any joint controllers who have commissioned the Services on your behalf, your emergency contacts, healthcare or domiciliary care providers or third parties engaged by us in the delivery of the Services.
How we will use your personal data
We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:
- where we need to perform a contract for the delivery of the Services;
- where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests;
- where we need to comply with a legal obligation; or
- to protect someone’s life.
Generally, we do not rely on consent as a legal basis for processing your personal data.
Justification for collecting and recording personal information
CG's Adult, Health and Wellbeing Department will collect the personal information in order to protect and provide support to Adults because it is part of our public task under Article 6 (1) (e) UK GDPR, in accordance with the Social Services and Well-being (Wales) Act 2014. Processing this personal information is necessary for the Department:
- to respond to Health and Social Care needs.
- as it is undertaking a task in the public's interest.
For special category data (namely information about health, ethnic group, sexual orientation), we will rely on Article 9(2)(h) which is health and social care.
The Department will not use your information for making automated decisions or for profiling.
Data we are allowed to collect:
- Date of Birth, name, address, family details,
- Phone Details
- E-mail address
- Personal reference number e.g. Social Services number, Health Service number
- Payment details where relevant
- Lifestyle and social circumstances
- Record of previous complaints
- Safeguarding reports
- Medical details
- Personal circumstances e.g. accommodation status
- Details of physical and mental health
- Race and ethnicity
- Religious beliefs
The records are kept on paper or on computer. They are dealt with confidentially and kept secure at all times.
Some types of information are sensitive e.g. health, race, ethnicity, religious beliefs. The legal basis for processing this information is because we provide a health and social care service.
Who is your information shared with?
We may share your information in the delivery of the Services:
- any joint data controller in respect of your personal data;
- you or your authorised representative;
- your named contacts i.e. next of kin, friends, relatives or carers;
- your named domiciliary care agency;
- any named contractors provided by a joint controller in respect of your personal data;
- your health practitioners or the emergency services;
- local authority representatives who may need to be contacted based on any concern raised in relation to your wellbeing
- relevant third parties where required by law;
- service providers (acting as data processors) based in England and Wales who provide IT and software services in support of the Services;
- regulators and other authorities based in the United Kingdom who require reporting of processing activities in certain circumstances; and
- We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.
International Transfers
We do not transfer your personal data outside the UK.
Data Security
We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.
We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.
How long do we retain this information?
We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.
To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.
The retention period for personal data collected in the provision of the Service is usually three years. Further detail of retention periods for different aspects of your personal data are available in our retention policy which you can request from us by contacting us using the contact details below.
Your rights under GDPR:
Under certain circumstances, you have rights under data protection laws in relation to your personal data. These rights are to:
- request access to your personal data;
- request correction of your personal data;
- request erasure of your personal data;
- object to processing of your personal data;
- request restriction of processing your personal data;
- request transfer of your personal data; and
- withdraw consent.
If you wish to exercise any of the rights set out above, please contact us using the contact details below.
You will not usually have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we could refuse to comply with your request in these circumstances.
We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.
We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.
For further information about the personal data which CCBC holds and its use, or if you wish to exercise your rights under the UK GDPR, please use the contact details below.
How to contact us?
For more information, or if you wish to obtain a copy of the application form on e-mail or in the post, please contact us on the following:
Customer Care Officer – Adults Service
- 01286 679 223
- gcgc@gwynedd.llyw.cymru
- Address: Customer Care Officer, Adults Services, Cyngor Gwynedd, Stryd y Jêl, Caernarfon, LL55 1SH