Privacy Notice - Safety and Insurance

Who we are

Spelthorne Borough Council's Health, Safety and Insurance Service is part of the Environmental Health Department.

We must comply with various legal obligations relating to insurance, audit requirements and Health & Safety legislation/requirements and therefore we require to collect personal data and information relating to our employees and third parties which will be recorded and maintained in the Spelsafe Safety Management System.

We aim for full transparency on how we gather, use and share personal information in accordance with the UK General Data Protection Regulation.

What information do we collect?

We will collect personal data about you which may include:

For Claims and reporting:

Name of staff, third party name, contact details including address and contact information,

Where relevant for the reported incident, accident or near miss;

• vehicle details,
• property details,
• location where the incident happened,
• health / medical data including injury details and treatment. This type of information is known as special category data because it is more sensitive.

This information is captured where a health and safety incident, accident or near miss is reported which involves employees of Spelthorne Borough Council or members of the public (known as 3rd party) affected by the work of Spelthorne Borough Council including, though not limited to:

• Service users, customers or members of public meeting Spelthorne Borough Council employees at Council premises including parks and open spaces, or elsewhere,
• Contractors or subcontractors, visitors, users of the Council's premises including parks and open spaces, when present at the premises,
• Councillors, volunteers, temporary and agency workers and consultants working on our behalf as well as anyone else working on behalf of Spelthorne Borough Council.

We also obtain personal information from other sources as follows:

• Witness statement(s),
• Where relevant additional information may be added by the line manager a part of the accident or incident process.
• Accident or incident manager's investigation will be completed by the line manager.

This may also include information that we receive from third parties. Depending on what type of request we are dealing with we may require your national insurance number, health records, vehicle or property details.

For the personal safety device provision to staff:

Personal information about employees such as name, work email address, work phone number, preferred contact number.  Where relevant health and other sensitive information.

The personal safety device collects the following information:

The device's location, voice recordings (when the SOS is triggered), message recording (optional).

Driving documentation:

Staff name and work contact details, including work telephone number and work email address together with information staff have given us including driver's licence number and details of your vehicle, insurance, tax and MOT certification.

How do we collect your information?

We will collect this information in a variety of ways. This may also include information that we receive from third parties e.g. other Insurance Companies.

What we do with it?

We use this personal data to ensure our legal compliance under the lawful basis of Legal Obligation.

The lawful basis for holding and processing special category data is:

• Employment, social security and social protection (if authorised by law),
• Legal claims or judicial acts.

We can use your personal data under many different Laws. The main ones are the Health and Safety at Work etc Act 1974, Management of Health and Safety at Work Regulations 1999, The consumer Insurance (Representation and Disclosure) Act 2012, but there are many more.

Who does the Council share your personal information with?

We are legally obliged to report RIDDOR accidents to the Health and Safety Executive.

We may report incidents of violent or aggressive behaviour towards our staff to the police, regardless of the location at which this occurs.

We may also report incidents of violent or aggressive behaviour or property damage taking place on our premises to the police. 

We may share information with:

• Third parties if necessary for legal/insurance/ audit purposes,
• London Borough of Sutton,
• Other services within the Council such as HR,
• Our provider's Alarm Receiving Centre.

How long does the Council keep your information?

For individuals who are a minor at the time of any incident/claim their personal data will be retained for 7 years after last action or until their 21st birthday whichever is the greater. 

For those who are adult personal data will be retained for 7 years after last action.

For employees and contractors, volunteers, personal data will be retained for 7 years after leaving the council's employment/ volunteering ends. 

We may sometimes share the information we have collected about you where it is necessary, lawful and fair to do so.  In each case, we will only share the minimum amount of information only when required.

Further information

You have the following rights:

• you have the right to be informed via Privacy Notices such as this or refer to:
  • Environmental Health Privacy Notice
  • Employee Privacy Notice
• you have the right to request access to and to receive a copy of any information we hold about you (including in an electronic format) - to request a copy of this information you must make a subject access request in writing
• if you find that the information Spelthorne Borough Council holds about you is no longer accurate, you have the right to ask to have this corrected
• you have the right - under certain conditions - to ask us to erase your personal data
• you may request that Spelthorne Borough Council stops processing your personal data in relation to any council service (this may delay or prevent us delivering a service to you, we will seek to comply with your request but may be required to hold or process information to comply with our legal duties)

To exercise any of these rights contact the Data Protection Officer, at data.protection@spelthorne.gov.uk.

You also have the right to make a complaint to the Information Commissioner's Office (ICO).  This is an independent body responsible for making sure that organisations comply with Data Protection legislation.

The ICO will always expect you to have raised your concerns with us before submitting a complaint.