How and why your information will be gathered, used, disclosed and managed.
Growing Sussex complies with the Data Protection Act 2018 and the General Data Protection Regulation (EU) 2016/679) (GDPR). This ensures that your personal data is processed fairly and kept securely for no longer than is necessary.
Types of information we collect and how we use it
The kind of information we gather and what we use it for.
To register your interest in becoming part of our pipeline and receive further information, you need to give us some personal information. We will hold this information until December 2029.
If you wish to remove your details from our system before this date and unsubscribe to our newsletter, please email [email protected]. These instructions can also be found at the bottom of each newsletter. Once we have received your data removal email request, we will action this within 14 days and send you one final confirmation email.
The type of information we collect
The information we gather may include:
- identity – name, organisation
- contact – email address, phone numbers
- technical – IP address, geolocation, browser and device information
How we use the information you provide
We use your data to:
- deliver and manage the services we provide to you
- respond to enquiries or complaints
- monitor the quality of our services
- research and plan new services
Personal and special category data
What we use personal and sensitive data for.
Personal data
We will only use your personal data when the law allows us to. The bases are set out in Article 6 of the General Data Protection Regulation (GDPR). In most cases the basis for processing is to enable the performance of a public task.
We will use your personal data in the following circumstances:
- Public task: to perform a task in the public interest or for an official function.
- Legitimate interests: to protect the interests of the Growing Sussex or someone else unless there is a good reason to protect your data which overrides those other interests.
- Consent: you have specifically agreed to our use of your data and we have no other legal basis for processing it.
Special category data (sensitive data)
We will only use your special category personal data when the law allows us to. The bases are set out in Article 9 of the GDPR.
We will use your special category data in the following circumstances, where processing:
- is with your explicit consent
- is necessary for reasons of substantial public interest
Who we share your information with
Others we might wish to share your details with.
Your personal information may be shared with internal departments of West Sussex County Council (WSCC), or external organisations and agencies involved in Growing Sussex.
We use external trusted services or suppliers who provide business support services, including IT security, building maintenance, hosting, archiving, data storage, email and text services and surveys.
We will only share your personal data when the law allows us to and in most cases the basis for sharing it is to enable the performance of a public task.
We will only share your special category data, under Article 9 of the GDPR, when the law allows us to.
Who we might share your information with
To enable Growing Sussex to provide relevant information to you we may share personal identifiable information within the Growing Sussex project team and organisational information to other parties. The following are examples of third parties who we may need to share your organisational information with, if appropriate.
- Current employers
- Schools, colleges, educators and examining bodies
- Goods and services providers
- Local and central government
- Elected members
- Press and the media
- Political organisations
- Professional bodies
- Survey and research organisations
- Students and pupils
- Data processors
- Partner agencies, approved organisations
We do not pass personal data to third parties for marketing, sales or any other commercial purposes without your prior explicit consent. We may process your personal information using web services hosted outside the European Economic Area (EEA), but only where a data processing agreement is in place that complies with obligations equivalent to those of the Data Protection Act.
Public funds
Growing Sussex must protect public funds and may use personal information and data matching techniques to detect and prevent fraud and ensure public money is targeted and spent in the most cost-effective way.
In order to achieve this, information may be shared with other bodies responsible for auditing or administering public funds, including:
- the Cabinet Office
- the Department for Work and Pensions
- other local authorities
- HM Revenue and Customs
- fraud investigation services
- the police
How long we will keep your personal data
See how long we retain your personal data.
We will only hold your personal data until December 2029.
It is important that the personal data we hold about you is accurate and up to date, so please tell us if your personal details change during your relationship with us.
Your rights
Your legal rights under the Data Protection Act and how to contact us.
You have the right to:
A) request access to your personal data
B) request correction of our records
C) request removal of data or limit our use of it – this right is not absolute and we may not be able to comply with your request
D) have personal data erased and prevent types of data processing in the following specific circumstances:
- where the personal data is no longer necessary in relation to the purpose for which it was originally collected or processed
- when you withdraw consent we have relied upon
- when you object to the processing and there is no overriding legitimate interest for continuing the processing
- personal data was unlawfully processed
- personal data has to be erased in order to comply with a legal obligation
- personal data is processed in relation to the offer of information society services to a child
E) object to processing – in some cases, we may need to explain that we have good grounds to continue to process your information
F) data portability – this right allows individuals to obtain and reuse their personal data for their own purposes for different services – this only applies to personal data provided by you, with your consent or for the performance of a contract, and when processing is automated
G) not be subject to automated decision-making, including profiling – this right only applies where the decision is based on automated processing and we do not undertake any automated decision-making, including profiling
H) withdraw consent (when this is the only basis for our use of your data)
If you have an issue to resolve
If you have any issues in relation to this Privacy Policy, please contact us via [email protected]. If you have any questions about this policy or want to exercise your legal rights, please use the email address above.
You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO). We would, however, appreciate the chance to deal with your concerns before you approach the ICO. If you have a complaint about why your information has been collected, how it has been used or how long we keep it for, contact the DPO.
Automated decisions and profiling
Automated decisions take place when an electronic system uses personal information to make a decision without human intervention. Automated decisions and profiling will not be undertaken by Growing Sussex.
Data security
The security measures we employ.
We have put in place security measures to prevent your personal data from being lost, used or accessed in an unauthorised way, altered or disclosed inappropriately.
We also limit access to your personal data to those employees, agents, contractors and other third parties who have a need to know in order for our service to be provided. They will only process your personal data on our instructions and are subject to a duty of confidentiality.
We have procedures to deal with any suspected breach of the rules about personal data and will notify you and the regulator of a breach where we are required to do so.
Electronic communications
We reserve the right to monitor and record electronic communications (website, email and phone conversations) for the purposes of keeping records, staff training, detection, investigation and prevention of crime.
Emails that we send to you or you send to us may be kept as a record of contact and your email address stored for future use in accordance with our record retention policy. If we need to email sensitive or confidential information to you, we will perform checks to verify the correct email address and may take additional security measures. If sending us such information, we recommend using our secure online forms where we provide them, Windows 365 or the postal service.
Website
Our website does not store or capture personal information of visitors using the site through general public access, but it does log visitors’ IP addresses. There are some cookies that are essential for the general running of our website, and some that are used to enable requested services. Using our website confirms your acceptance of our use of cookies.
Complaints
How we use your personal information to investigate a complaint.
We will use your personal information to investigate a complaint and check on our level of service. We compile and publish statistics showing information, such as the number of complaints we receive, but not in a form that identifies anyone.
No third parties have access to your personal information unless the law allows them to do so. However, if you have made a complaint to us about someone else or another organisation, we usually have to disclose your identity to them to enable the complaint to be dealt with appropriately and in context. This also means we may receive information about you from them.
If you don’t want information that identifies you to be shared with the organisation you want to complain about, we’ll try to respect that. However, it is not always possible to handle a complaint on an anonymous basis, so we’ll contact you to discuss this.
If you are acting on behalf of someone making a complaint, we’ll ask for information to satisfy us of your identity. If relevant, we may also ask for information to show you have authority to act on someone else’s behalf.