Vale of Glamorgan Council Privacy Notice

The Vale of Glamorgan Council is committed to protecting your privacy when you use Council services. Your privacy matters!

What is a privacy notice? What is this all about?

Your privacy is important to us and a privacy notice explains how we manage personal information (also known as personal data) about you and the ways in which we protect your privacy, it explains how you can access your information, what rights you have in relation to information and how to exercise those rights.

This is the Council’s main privacy notice, some service areas will have privacy notices specific to the information they hold and if they do they will tell you.

The Council processes personal data on a day-to-day basis. Personal data is information, which can identify you and is personal to you such as your name, address, date of birth, telephone number, e-mail address, contact preferences, NHS number, National Insurance number, financial information, details about your lifestyle, employment or hobbies.

The Council also processes on a day-to-day basis, sensitive personal data. This includes for example physical, physiological and mental health, sexual orientation, medical records, biometric information, information about whether or not you are in a trade union and religious or philosophical beliefs.

The above are examples only of personal data and sensitive personal data.

The Council provides a significant number of services and support to citizens within the Vale of Glamorgan. The Council collects and uses personal and/or sensitive personal information to operate effectively and to provide support and services across a diverse number of areas. It includes information on current, past and prospective employees, citizens, Members, suppliers, clients / customers, residents, tenants, partners and others with whom it communicates.

The Council shares your personal information sometimes with others outside of the Council such as the NHS, police, DWP, HMRC, other public sector organisations and private organisations. The Council will only share your information where it is legally allowed. The Council will take measures to try to ensure that the information is shared safely and securely.

The remainder of this page explains in detail what this means.

What personal data we hold and how do we obtain it?

The types of personal data the Council holds and processes about you have been set out above as an overview but just to explain further it can include:

Contact details, including name, address, telephone numbers and email address.
Identifying details, including date of birth, national insurance number and employee and membership numbers.
Information that is used to calculate and assess eligibility for benefits.
Financial information relevant to the calculation or payment of benefits, for example, bank account and tax details.
Information about your family, dependents or personal circumstances, where required by a relevant service.
Information about your health where required by a relevant service such as Social Services.
Information about a criminal convictions where relevant.

Please note that the Council may obtain information directly from you or from other organisations such as Schools, NHS, charities, DWP, police, HMRC, or friends and family or neighbours or Councillors.

You should also be careful that if you are giving personal information on behalf of others, you have advised them that you will be sharing their information with the Council.

How we will use your personal data

The Council may process your personal data to fulfil its obligations and this can include the processing of your personal data for all or any of the following purposes:

to contact you.
to assess eligibility for our services including calculating and providing you with benefits.
to identify your potential or actual benefit options.
for statistical and reference purposes.
to comply with our legal and regulatory obligations as a Local Authority.
to address queries from you and to respond to any actual or potential disputes concerning you.
To provide you with access to Council Services and/or to ensure you receive Services to assist you.
Employment.

The above list is not limited to these examples.

From time to time the Council will share your personal data with partner organisations and service providers so that they can help the Council to carry out its duties, rights and discretions in relation to the services provided. Some of those organisations will simply process your personal data on behalf of the Council and in accordance with the Council’s requests. In each case, the Council will only share data to the extent that it is considered the information is reasonably required for these purposes.

Any personal information the Council holds will be disclosed, with reasonable purpose to:

Our staff – where the information is vital and required for their work.
The Courts - under the direction of a Court Order.
Welsh Government - in line with statutory requirements or where we administer a scheme on their behalf.
Our partners – strictly in line with agreed procedures and lawfully in compliance with UK GDPR.
Other public bodies such as neighbouring Councils, NHS, HMRC, DWP, Trusts, the police.

Under the Digital Economy Act 2017, the Council may share personal data provided with other Council’s for the purposes of fraud, crime detection/prevention, to improve public service delivery, statistical research.

The Vale of Glamorgan Council has a duty to protect the public fund it manages. Therefore, the information that you have provided to us may be used for the prevention and detection of fraud or shared with Council Officers responsible for auditing or administering public funds.

Where requested or if the Council considers that it is reasonably required, it may also provide your data to government bodies and dispute resolution and law enforcement organisations, including those listed above, the Pensions Regulator, the Pensions Ombudsman and Her Majesty’s Revenue and Customs (HMRC). They may then use the data to carry out their legal functions.

In some cases recipients may be outside the UK. This means your personal data can be transferred outside of Europe to a jurisdiction that may not offer an equivalent level of protection. If this occurs, the Council is obliged to verify that appropriate safeguards are implemented with a view to protecting your data.

The legal basis for our use of your personal data

The Council holds personal data in its capacity as a data controller. A data controller decides why and how personal data is used. The Council will consider the reasons it is using your data. It might use your data to calculate, secure and pay your benefits, to provide services to you, to provide information to other organisations about you or for statistical and reference purposes. Under the Data Protection Act the Council must have a legal basis for using your data/information.

This will generally be one or more of the following reasons:

To satisfy a legal obligation;
To carry out a task in the public interest or in the exercise of official authority as a public body; [and/or]
To meet our contractual obligations to you;
To protect the vital interests of the data subject or of another natural person.

What do we do to keep your data safe and to ensure it is fairly processed

The Council works to ensure that its systems around personal information operate by design and not default, it:-

Strengthens processes in relation to the handling of personal information;
To comply fully with Data Protection law;
To perform Council business;
Ensure personal information is only held for as necessary;
Ensure that personal information is maintained accurately;
Only use personal data for reasons it is allowed to;
Be transparent;
Take immediate action if personal data is found not to be used appropriately;
Reviews and scrutinises its processes to improve where possible;
Listens to concerns when raised and addresses concerns.

How long we keep your personal data

The Council will only keep your personal data for as long as it needs to in order to fulfil the purpose(s) for which it was collected. The Council will only retain it afterwards for so long as may be required to deal with any questions or complaints or for as long as necessary for legal or regulatory reasons.

More specific details regarding how long the Council retains information for can be found in the Council’s retention schedule.

Your rights

You have a right to access and obtain a copy of the personal data that the Council holds about you and to ask the Council to correct your personal data if there are any errors or it is out of date.

In some circumstances you may also have a right to ask the Council to restrict the processing of your personal data until any errors are corrected, to object to processing or to transfer or (in very limited circumstances) erase your personal data.

In some circumstances, you have the right to withdraw your consent to the use of your data at any time by notifying the Data Protection Officer in writing.

If you have any questions, queries or concerns regarding how the Council has your data, what data it holds about you or what it does with your data, you can contact the Council’s Data Protection Officer. You can also make complaints to the Data Protection Officer including complaints about this Privacy Notice or any of the Council’s activities regarding your personal data.

How to contact the Council’s Data Protection Officer

The Council has a dedicated Team of staff responsible for responding to matters relating to the use of personal data, called the Information Governance Team. They report to the Council’s Information Governance Manager who is also the Council’s Data Protection Officer (DPO).

To contact the DPO in relation to matters referred to in this Privacy Notice, e-mail:

DPO@valeofglamorgan.gov.uk

Or you can call them via the Council’s contact centre on:

01446 700111

Or you can write to them at the following address:

Legal Services Department,

Vale of Glamorgan Council,

Civic Offices,

Holton Road,

Barry,

Vale of Glamorgan,

CF63 4RU

The Information Commissioners Officer (ICO)

If, having contacted the Council’s Data Protection Officer you are dis-satisfied with any aspect of how your personal information is handled by the Council you can contact the ICO. We do ask that you give the Council opportunity to try to resolve the concerns with you where possible. However, it is a matter for you.

The ICO are the UK’s independent body set up to uphold information rights. They also provide information about your rights. Their contact details are:

Information Commissioner’s Office

Wales Second Floor,

Churchill House Churchill Way,

Cardiff

CF10 2HH

029 20678400 / Fax:029 20678399
wales@ico.org.uk

Updating this notice

The Council may update this notice periodically. Where this happens, you will be able to see the changes and the date of the changes. This Privacy Notice was last reviewed in November 2023. If you wish to see the previous version prior to update please contact the Data Protection Officer at the contact details set out above.

Last reviewed and updated: 14 Septemeber 2026