Inspire Privacy Statement

This privacy statement tells you what to expect when Inspire collects personal data. It applies to information we collect about:

• visitors to our website

• people who register for library or Inspire membership

• people who register for and use our services

• people who are referred to us by other persons, agencies, organisations

• people who contact us with an enquiry or complaint

• job applicants and our current and former employees

• people who participate in publicity for Inspire

• people who are recorded on CCTV operated by Inspire

Personal data means any data which can be used to identify an individual. The following are examples of personal data that Inspire may collect or receive: personal contact details such as name, address, phone number, etc.

• personal identifiers such as a National Learning Number

• visual images, personal appearance and behaviour

• personal or professional opinions about an individual

• family details

• employment and education details

• student and pupil records

• lifestyle and social circumstances

• pension or financial activity records

• offences (including alleged offences)

• criminal proceedings, outcomes and sentences

• health details

• racial or ethnic origin

• data concerning a natural person’s sex life or sexual orientation

• trade union membership

• political affiliation

• political opinions

• religious or other beliefs of a similar nature

Personal data can be in any format including:

• written letters

• emails

• video recordings

• audio recordings

• photographs

• meeting minutes

• reports

• digital files

We may need to use personal data for the following purposes:

• the activities and functions we are contacted to deliver on behalf of Nottinghamshire County Council, the Arts Council, the Education and Skills Funding Agency, the National Archives, and our other funding bodies

• delivering Inspire services including, libraries, learning, arts, archives and cultural activity

• delivering services and support to customers and service users

• managing and monitoring those services

• service planning

• dealing with and investigation of enquiries and complaints

• responding to requests for information

• complying with legal requirements or Court Orders

• supporting and managing workers; for instance, recruitment, provision of HR, payroll, and occupational health services

• health and safety

• managing our property

• administering the Local Government Pension Scheme, the People’s Pension scheme, and the Teachers’ Pension Scheme

• internal financial support including maintaining our own accounts and records

• emergency planning

• supporting the functions of other agencies

• processing on behalf of other persons

• carrying out surveys and audits

• reporting to Government, professional and supervisory authorities

• carrying out Disclosure and Barring Service checks

• crime prevention

• archiving records

• historical and statistical research

• equal opportunity and diversity monitoring

• decision making

Data protection law allows us to use or share personal data in any of the following circumstances:

With consent;

• when we have your (or your appointed representative's) consent. For example, you may have indicated your consent on a paper form or on-line or on our website.

Without consent;

• where we have a contract with you or you have asked us to process your data prior to entering onto a contract

• where we are under legal obligation that requires us to process your data prior to entering onto a contract

• when we are protecting your vital interests, or those of other persons. For example, sharing details from your health information with a medical professional in an emergency

• where Inspire is carrying out a task/function in the public interest, for instance, when providing a service that it has lawful authority to provide, such as library services

• where we or another organisation has a legitimate interest and need to use information for a specific purpose that does not unjustifiably infringe on your rights or freedoms

• where it is necessary for the performance of a law enforcement task

The following special categories of data are sensitive personal data that we only use or share when additional conditions apply. Special category data is likely to include anything that can reveal your:

• racial or ethnic origin

• political opinions

• religious or philosophical beliefs

• trade union membership

• genetic data

• biometric data (where used for identification purposes)

• physical or mental health

• sex life or sexuality.

Data protection law permits us to use or share special category data only in one or more of the following circumstances:

• where we have explicit consent

• where it is necessary for social care or health care purposes

• where it is necessary for the assessment of the working capacity of an employee

• where it is necessary for medical diagnosis

• where it is necessary for the vital interests of an individual and the individual is unable to consent because they are physically or legally incapable

• where it is necessary for employment and social security and social protection law

• where it is necessary for reasons of substantial public interest and for:

• performing a statutory function

• for the administration of justice

• the provision of counselling or other confidential services

• the prevention or detection of crime

• fraud prevention or protecting the public against dishonesty or other improper conduct

• for insurance purposes or occupational pensions

• for obtaining legal advice or for the purposes of legal proceedings

• for responding to Councillors’ enquiries

• for equal opportunity and diversity monitoring purposes;

• for research and archiving purposes

• where the information has already been made public by the individual concerned

We will also only process personal data about criminal convictions or offences when specific conditions provide lawful authority for us to process that data.

To ensure that the Inspire provides you with an efficient and effective service we will sometimes need to share your information with other parties that support the delivery of the service you may receive.

We may provide personal data to (or receive personal data from):

• customers and service users

• family, associates or representatives of the person whose personal data we are processing

• healthcare, social and welfare organisations

• healthcare professionals

• mental health assessors

• care homes and care providers

• local and central government bodies

• adoption agencies

• voluntary and charitable organisations

• current past and prospective employers

• agency workers and contractors

• consultants

• trade unions

• professional bodies

• the disclosure and barring service

• service providers and other suppliers of goods and services

• buyers of goods and services

• professional advisers and consultants

• financial organisations

• pensions regulators and pensions authorities

• customs and excise

• ombudsman and regulatory authorities

• press and the media

• courts and tribunals

• legal representatives, defence solicitors

• law enforcement and prosecuting authorities

• police forces

• prisons and the probation service

• partner agencies, approved organisations and individuals working with the police

• debt collection and tracing agencies

• private investigators

• security companies

• political organisations

• licensing authorities

• waste collection authorities

• religious organisations

• schools and academies

• educators and examining bodies

• students and pupils including their relatives, guardians, carers or representatives

• survey and research organisations

• press and the media

• MPs, councillors and other elected representatives.

In some circumstances we may need to transfer personal data (including sensitive personal data) to other organisations based outside the UK, including countries or territories which are outside the European Economic Area. When we do so we will ensure that procedures and technologies are in place to maintain the security of all personal data which is processed overseas.

In some circumstances we may need to transfer your personal data to organisations in the USA. The EU and USA have agreed a new Data Privacy Framework, allowing US organisations which are signed up to this framework to be considered adequate for data protection purposes. The UK now has an extension to the EU/ US Data Privacy framework (the UK - US Data Bridge) which allows the UK to transfer personal data only to those organisations in the USA which have signed up to this.

If we transfer your data to US organisations which are not signed up to the framework, we will continue to consider this a restricted transfer and ensure appropriate legal controls are in place to ensure the data transfer is safe and in keeping with UK regulatory requirements.

We maintain information in accordance with our retention schedules which specify timescales for how long we hold your information. The law may specify the minimum amount of time we have to retain certain information. Please contact Inspire for more information.

We will take appropriate steps to make sure we hold records about you in a secure way. We have put in place procedures and technologies to maintain security of personal data from the point of collection to the point of destruction. All employees are given training in information security and data protection standards and are obliged to respect the confidentiality of your personal data.cc

You have a number of rights that you may exercise in relation to your personal data. Some of the rights do not apply automatically and may not be available in certain circumstances where a lawful exception applies.

You have a right to access your personal data. You can request a copy of personal data that we hold about you and ask us to explain how we use your data.

You have a right to object to processing of your personal data. You have an absolute right to stop your data being used for direct marketing. In other cases where the right to object applies, we may be able to continue using your data if we have a compelling reason for doing so.

If we are relying on consent as the lawful basis to process your data you can withdraw your consent at any time, and we will stop further processing.

You have a right to request the restriction or suppression of your personal data.

You have a right to have your personal data erased if we no longer have a legitimate use for it. This right is sometimes called the ‘right to be forgotten’.

You have a right to rectification of your personal data if the information we hold in relation to you is inaccurate or incomplete.

You have a right not to be subject to any decision based solely on automated processing, including profiling, which produces legal or similarly significant effects. You can request human intervention or challenge any solely automated decision-making that significantly affects you.

If you would like to request access to your personal data or exercise any of your other data protection rights, please contact Inspire Data Protection Officer at the address above.

What information do we collect when you visit our website?

The computers which host our website maintain logs which include the Internet Protocol (IP) addresses of all devices that access our pages. We only use these logs to determine website usage and not to identify or obtain information about specific users. IP information is treated as confidential and is not published or shared with any third party.

Please read our separate cookies notice for information about how we use cookies on our website.

Registering for online services

We collect personal data that you provide to us when you register for an online account.

We collect personal data when you apply to access some of our services online.

In general, we will hold your personal data for the purposes of maintaining and operating your account or registration and will use your personal information:

• for the purpose you provided the information for

• to verify your entitlement to access the services you have requested, e.g. verification of your residence in the county. (We may do this by checking with a third party)

• to verify your entitlement to access the services you have requested, e.g. verification of your residence in the county. (We may do this by checking with a third party)

• where you give specific consent to allow us to be able to communicate and provide information about services appropriate to your needs.

We will retain your information for the period necessary to fulfil the relevant purpose for which it is held, and we will also retain any external verification so long as it remains accurate based on the information you provide to us. This will allow us to reuse that information when you register for additional services.

Photographic images

Images of individuals are treated as personal data. Images of crowds in a public area are not. When taking photographs intended for publication on our website or elsewhere, it is our policy to seek the written permission of any individuals who are photographed.

We will respond promptly to any request to remove photographic images and/or personal data from the website where the person making such a request has a right to do so in accordance with their data protection rights.

Links to other websites

This privacy statement does not cover the links within this site linking to other websites. We encourage you to read the privacy statements on other websites you visit.

We keep our privacy statement under regular review.

Any changes we make to our privacy statement will be posted on this page. Please check back frequently to see any updates or changes to our privacy statement.

This privacy statement was drafted with brevity and clarity in mind. It does not describe all aspects of Inspire’s collection and use of personal data. If you would like any additional information or explanation, please contact the Data Protection Officer.

If you have questions about this privacy statement or about how we use your personal data, you can contact Inspire’s Data Protection Officer (DPO) at the address noted above.

You can seek advice and have the right to make a complaint to the Information Commissioner’s Office. The ICO is an independent body set up to uphold information rights in the UK. You can contact them through the Information Commissioners Office website, their helpline on 0303 123 1113, or in writing to:

Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.