Privacy policy

We need your personal data in order to provide you with services that you apply for or receive from us and also where we are required to use information in order to meet our statutory obligations. We will only collect personal data that is absolutely necessary and any information we collect about you will be strictly in accordance with the data protection law and other statutory obligations which we are bound by.

We process your information for the following services:

• housing needs and homelessness services
• adults social care services
• encompass innovate services
• renttl.co.uk (please see separate privacy policy at https://www.renttl.co.uk/privacy-notice )
• employment

In addition to providing the services above, you personal information is also processed for these additional purposes:

• fulfil our legal duties and obligations (including safeguarding children)
• provide efficient and effective services
• help you access the right services
• collect debts
• prevent, detect and prosecute fraud, corruption or other crimes
• personalise repeat visits to our website
• deliver national government programmes and initiatives.

You will be advised of any further additional purposes or uses at the time the information is collected or used.

Encompass LATC LTD has statutory obligations to collect, process and share personal information without consent, with our partners such as the NHS, housing associations, schools, central government, such as DWP, HMRC, Home Office, Dept. Of Education, Dept. of Health, other councils and law enforcement agencies such as the Police and the Crown prosecution service, for the following purposes:

• health and wellbeing and public health
• safeguarding of vulnerable adults and children
• the prevention and detection of crime
• the assessment of any tax or duty
• collection of debt
• if we are required to do so by any court or law
• prevention of fraud
• the national fraud initiative
• protect you or other individuals from serious harm
• protect public funds
• public safety and law enforcement
• criminal or civil prosecution of offenders
• national security

To ensure that Encompass LATC provides you with an efficient and effective service we will sometimes need to share your information between teams within the council. We may also share your information with our partners to deliver national government programmes and initiatives, or improving services we deliver, or provide the services you agreed to receive.

We may share with:

• NHS (GP’s, Hospital, Mental Health, CCG’s etc.)
• schools
• voluntary sectors
• central government
• other councils
• housing associations

In most cases this will be done where there is a lawful basis under the conditions set out in data protection laws. We may also share your information with third party service providers working on our behalf for the purposes of completing tasks and providing services to you on our behalf (for example; domiciliary care providers). However, when we use third party service providers, we disclose only the personal information that is necessary to deliver the service and we have a contract in place that requires them to keep your information secure, as required by the Data Protection Act 2018 and UK General Data Protection Regulation (UK GDPR) and not to use it for any other purposes.

We will never use or share your personal information to third parties for marketing purposes without your permission.

If you are receiving a service from us that we provide on behalf of the London Borough of Sutton, we may share some of your information, for example your name and address, internally with other departments in the Council if this:

• helps you to access services more easily
• promotes the more efficient and cost effective delivery of council services
• helps recover monies owed to the council

Encompass must have a lawful basis for processing your information. In most cases the information will be collected and used where we have statutory obligations to collect, use or share your information; in those instances we have a public interest basis for processing your information. In some instances the services we provide are optional which means that Encompass will only provide the service if the customer has requested the service or the customer consents to the service. In that instance, consenting to the service does not necessarily mean that the lawful basis for processing your information is consent; Encompass may rely on the public interest basis where it has specific powers to provide the service.

Where your consent is required to process your information we will seek your consent. However, where your consent is not required to process your information, for example where Encompass has a lawful basis for processing your information, your consent will not be sought. Where we need to disclose sensitive or confidential information such as medical details to other partners, we will do so only with your prior explicit consent unless we are legally entitled to share the data.

Encompass may also process your information where processing is necessary for the performance of a contract and where processing is necessary to protect your vital interest or the vital interest of another person. Encompass may also process your information where we are obliged to process your information to comply with the law.

Where we have statutory authority to collect and process your personal information for the provision of our services, your consent is not required to process your information. Where the service is optional, we will not process your information until you have consented to receive the service. Once we have your consent for the service, your information will be processed under our statutory authority to provide the service.

We review our retention periods of the information we hold about you on a regular basis. We are legally required to hold some types of information to fulfil our statutory obligations. We will hold your personal information on our systems for as long as it is necessary for the relevant activity or service that we provide to you, or as required by law.

We will retain your information for the period in which your information is being used for service provision or for our wider functions including debt collection. Where we have statutory authority to process your information; your right to be forgotten does not apply to our functions and services

Only those staff involved in providing the relevant service to you can see the information – this may include social workers, housing officers, assessment officers, occupational therapists, mental health workers, administrative staff and some colleagues from other council services.

All our staff are required to abide by a strict code of conduct on confidentiality and information sharing. We emphasise the importance of sharing information at an early stage to ensure you get the service you require.

We may also share some information with other staff who do not work for us but are involved in providing support to you. This may include, for example, your GP or care provider.

In circumstances where the disclosure of personal data is necessary, our staff understand when, why and how to share information.

This includes:

• asking for your consent at the outset, and recognising when consent may not be required
• only sharing information with those who need to know in order to provide you with good quality care or housing services
• sharing the minimum necessary to ensure good quality care
• sharing information for legal or contractual reasons or if in the public interest or to reduce risk of significant harm

Upon visiting our website, cookies are used to collect information about website usage.

Cookies are also set when you:

• click on social networking buttons in our pages such as facebook and twitter
• watch videos
• register for services
• take part in online surveys

Encompass always acts upon your choices around what type of communications you want to receive and how you want to receive them. Where you have signed up for one of our newsletters, we use email newsletters to inform you of what we’re doing, news and events.

Tools may be used to help us improve the effectiveness of our communications with you, including tracking whether the emails we send are opened and which links are clicked within a message. This helps us to improve and refine future email marketing around our campaigns and make sure all our emails are relevant and useful as possible.

You have a choice about whether or not you wish to receive information from us. If though you no longer want to receive our e-newsletters, then you can do this by clicking the unsubscribe link on marketing emails we send.

Encompass uses Google Cloud Platform in the provision of its services and wider functions. This means that your personal and sensitive data is stored and processed on servers outside of the European Economic Area (EEA). Google has certification under the EU-U.S. and Swiss-U.S Privacy Shield Frameworks; this means that there is an adequate level of security for data processing and therefore your data is being processed lawfully.

As an entity wholly owned by and working on behalf of Sutton Council, we, along with other agencies such as schools and early years settings, process information about children and young people in order to administer service provision. In doing so we must comply with the Data Protection Act (2018). This means (amongst other things) that the data held about children must only be used for specific purposes allowed by law.

• the right to be informed
• the right of access
• the right to rectification
• the right to erasure
• the right to restrict processing
• the right to data portability
• the right to object
• rights in relation to automated decision making and profiling
• the right to lodge a complaint with the Information Commissioner’s Office (ICO)

Under UK GDPR and the Data Protection Act, you, as a ‘data subjects’, are entitled to have access without undue delay and within one month following a request to information we hold regarding your personal details.

Under the Act you are also entitled to:

• a description of the data being processed
• the purposes for which it is being processed
• a description of the recipients
• the source of the data
• where any decision is taken based solely on an automated process.

These are called subject access requests (SAR’s). There are some exemptions to disclosure of information to data subjects under the terms of the Act. The Data Protection Act does not give third parties rights of access to personal information about individuals still living.

To request a copy of this information you can make a subject access request in writing, either via email or a letter to:

contact@encompass-latc.co.uk

Data Protection Team
Encompass LATC LTD
Sutton Gate
1 Carshalton Road
Sutton
SM1 4LE

Alternatively you can make the request verbally to a member of Encompass staff.  Regardless of how you tell us, to ensure that we can deal with your request as efficiently as possible you (or the person the request is made on behalf of) will need to include your current name and address, proof of identity (a copy of your driving licence, passport or two different utility bills that display your name and address), as much detail as possible regarding your request so that we can identify any information we may hold about you, this may include your previous name and address, date of birth and what service you were involved with.

Encompass LATC must respond within a month, which may be extended by a further two months if the request is complex and the service is nornally free. If we are not the Controller of the data you have requested we will assist you in directing your enquiry to the relevant organisation.

We will send you a copy of all the information we hold on you. Any third party information will be redacted unless we have consent from the third party to provide it. 

Some information may fall under an exemption from GDPR regulations. We will justify and document our reasons for relying on any exemption.

We operate a Data Retention Policy to ensure that information is not held for longer than necessary. Your subject access request and paperwork will be kept for three years and then securely destroyed.

We may analyse your personal information to improve services and for the following purposes:

• undertake statutory functions efficiently and effectively
• service planning by understanding your needs to provide the services that you request
• understanding what we can do for you and inform you of other relevant services and benefits
• help us to build up a picture of how we are performing at delivering services to you and what services the people of the borough need
• analysis of costs and spend of services we provide so that we can to ensure better and efficient use of public funds

In order to do this we collect, use and share Aggregated Data such as statistical or demographic data. Aggregated Data may be derived from your personal data but is not considered personal data in law as this data does not directly or indirectly reveal your identity. For example, we may aggregate your Usage Data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this privacy notice.

If you suspect that there has been, or there is a risk of there being, a breach of UK GDPR or the Data Protection Act in the way in which we or our partners or subcontractors handle personal information, then please contact us and ask for the Data Protection Officer. Encompass LATC LTD is however committed to using pseudonymised or anonymised information as much as is practical, and in many cases this will be the default position. Pseudonymisation is a procedure by which the most identifying fields within a data record are replaced by one or more artificial identifiers, or pseudonyms. There can be a single pseudonym for a collection of replaced fields or a pseudonym per replaced field. Anonymisation is the process of removing identifying particulars or details from (something, especially medical test results) for statistical or other purposes.

Any changes we make to this Privacy Notice will be posted on this website. Please check here frequently to see any updates or changes to our Privacy Notice.

As a local authority trading company we provide many of our services on behalf of the London Borough of Sutton. However we also provide services independently. The way in which we use and share your information differs depending on which of our services you are accessing. If you are accessing a service that we provide independently of the council we will not share your information with them without seeking your explicit consent.

The Information Commissioner’s Office (ICO) is the UK’s independent body set up to uphold information rights. If you would like to know more about your rights under the Data Protection law, and what you should expect from us, visit the  the ICO website at www.ico.org.uk

If you have any concerns regarding our privacy practices or about exercising your Data Protection rights, or you are dissatisfied with how Encompass have responded to a complaint about the way in which we have processed your personal information, you have the right to lodge a complaint to the ICO at the following address:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF