Armed Forces Covenant Hub
To comply with the UK General Data Protection Regulation (UK GDPR), where personal data relating to a data subject is collected, Lancashire County Council would like to provide you with the following details.
Contact details of this Lancashire County Council service:
Note that for queries intended for this specific service, do not contact the Data Protection Officer (DPO) mailbox, instead please direct your query to the following point of contact:
Armed Forces Covenant Project Manager
Reasons for processing your personal data
We process your personal information to help identify, understand and respond to your needs and to ensure you can access the most appropriate support available.
Your information is used to enable organisations to work together in a coordinated way, particularly where support may involve more than one service or provider. This allows relevant partners to share insight, avoid duplication, and ensure that support is aligned and delivered effectively.
We also use personal data to:
assess and respond to individual circumstances, including complex or changing needs
facilitate appropriate referrals and introductions to other organisations who can provide support
protect individuals and families where there may be safeguarding or welfare concerns
improve how services are delivered by identifying common needs, gaps in provision and opportunities for better coordination
ensure public services and partner organisations can meet their responsibilities to support the Armed Forces community
Overall, processing personal data in this way helps ensure that support is timely, joined up and tailored to individual circumstances, so that people do not have to navigate multiple services on their own.
Use of artificial intelligence (AI) technologies
We are increasingly utilising AI technologies to process your personal data. This is primarily utilised within Lancashire County Council using Microsoft Copilot Web and Microsoft Copilot 365. Please consult our Artificial Intelligence privacy notice for more details of how we use these specific platforms.
We do not use AI to make automated decisions. There is always a human intervention to review and approve any outputs from the AI tools. Decisions are not made solely by automated means.
We may use approved artificial intelligence (AI) tools to support the administration and operation of the Lancashire Armed Forces Covenant Hub. This includes tasks such as preparing meeting materials, summarising information, drafting communications and identifying general trends from anonymised data.
AI is used in a controlled and proportionate way and is limited to supporting tasks. It is not used to make decisions about individuals, determine eligibility for support, or replace professional judgement.
Where AI tools are used:
they are deployed within secure, approved council systems
personal data is minimised and anonymised wherever possible before use
outputs are reviewed and checked by staff to ensure accuracy and appropriateness
appropriate safeguards are in place to protect sensitive information
Any decisions about support or services are always made by people, not by automated systems.
Legal basis for processing personal data
We process your personal data under the following lawful bases:
Public task (Article 6(1)(e)) – processing is necessary to perform functions carried out in the public interest or under official authority. This includes coordinating support, promoting wellbeing, and helping ensure that members of the Armed Forces community can access appropriate services.
Legal obligation (Article 6(1)(c)) – in certain circumstances, we may process and share personal data where we are required to do so by law, for example in relation to safeguarding individuals or meeting statutory duties.
Legitimate interests (Article 6(1)(f)) – partner organisations involved in providing support (particularly voluntary and charitable organisations) may process personal data where it is necessary for their legitimate interests, provided these are not overridden by your rights and freedoms.
These lawful bases enable organisations to work together effectively to provide coordinated, timely and appropriate support, while ensuring that any use of personal data is necessary and proportionate.
Legal basis for processing special categories of personal data
Some of the information used to support you may be more sensitive (known as “special category data”), such as information about your health, wellbeing, or circumstances. Where this is necessary, we process this information under the following conditions:
Health or social care purposes (Article 9(2)(h)) – processing is necessary to assess needs, provide care or support, and coordinate services across organisations involved in your wellbeing.
Substantial public interest (Article 9(2)(g)) – processing is necessary for wider public interest reasons, including safeguarding individuals, protecting people from harm, and ensuring appropriate support is provided to vulnerable groups.
Public health (Article 9(2)(i)) – in limited circumstances, anonymised or aggregated information may be used to understand broader needs and improve services for the Armed Forces community.
These conditions ensure that sensitive information is only used where it is necessary, appropriate and supported by relevant legal safeguards, and that it is handled in a controlled and proportionate way.
Legal basis for processing criminal offence data
In limited circumstances, we may process information relating to criminal convictions, offences or related matters where this is necessary to support your needs or ensure the safety and wellbeing of you or others.
Such information is only processed where there is a clear and lawful reason to do so.
This includes where it is necessary:
to safeguard children or vulnerable individuals
to assess risk and ensure appropriate support arrangements
to support rehabilitation, wellbeing, or coordinated multi-agency assistance
to meet legal or statutory responsibilities held by public authorities
Where used, this type of information is handled with a high level of care and is only shared with organisations directly involved in providing support, on a strict need-to-know basis.
Processing is supported by relevant provisions under data protection law which allow the use of this information where it is necessary for public functions, safeguarding, or the administration of justice, and is always carried out in a proportionate and controlled way.
Information we process about you
We may process a range of personal information to help understand your circumstances and ensure you receive appropriate support. This can include:
Basic personal details – such as your name, address, date of birth and contact information
Your connection to the Armed Forces community – for example whether you are serving personnel, a veteran, reservist, or a family member or dependant
Information about your needs and circumstances – such as housing, employment, financial situation, family context, or support you are currently receiving
Contact and communication preferences – to help us engage with you in a suitable and effective way
Sensitive (special category) information – where necessary, this may include details about your health, wellbeing, disabilities, or other information relevant to providing appropriate support
Safeguarding or risk-related information – where there are concerns about safety, vulnerability or welfare
Information about people connected to you – such as family members or dependants, where this is relevant to understanding your situation
In addition, we process limited information about professionals and organisations involved in supporting you, such as names, roles and contact details, to enable effective coordination.
Where possible, information is initially considered in a non-identifiable (anonymised) way, and identifiable details are only shared when necessary to provide support.
Recipients of the personal data that we process about you
Your personal information may be shared with relevant organisations where this is necessary to provide you with appropriate support. These organisations work together as part of a coordinated network but remain responsible for their own use of personal data.
Recipients may include:
Lancashire County Council services – where we are directly involved in providing or coordinating support
Health services – such as NHS organisations, including GPs, hospitals and other healthcare providers
Local authorities – including district and borough councils, particularly where housing or local services are involved
Police and safeguarding agencies – where necessary to protect individuals or manage risk
Charities and voluntary sector organisations – including Armed Forces charities and specialist support providers
Other public sector organisations – such as government departments, education providers or employment services, where relevant to your needs
Information is not routinely shared with all partners. It is only shared where there is a clear purpose and with organisations that are directly involved in supporting you.
Wherever possible, information is initially discussed without identifying you, and your identifiable details are only shared when it is necessary to deliver support.
All organisations receiving personal data are expected to handle it securely and in line with data protection laws.
Any transfers to another country
Your personal data is not routinely transferred to or processed outside the United Kingdom.
Information is primarily held and managed within UK-based systems by the organisations involved in supporting you. Where technology providers (such as secure cloud-based services) are used to store or manage information, appropriate safeguards are in place to ensure your data remains protected.
If, in exceptional circumstances, personal data is transferred outside the UK, this will only take place where suitable legal and security measures are in place to protect your information and ensure it is handled in line with data protection law.
Retention periods
Lancashire County Council will only store your information for as long as is legally required or in situations where there is no legal retention period they will follow established best practice.
File type | Description | Security | Retention period |
|---|---|---|---|
Partner contact database (gatekeepers) | Professional contact details used to manage the partner network and coordinate Hub activity. | Stored within secure LCC systems with role-based access controls. | Reviewed annually; retained while individual remains in role and deleted within 12 months of leaving or becoming inactive. |
Hub meeting agendas and minutes (anonymised) | Records of meetings including anonymised case discussions and actions. | Stored on secure LCC systems with restricted access. | Retained for 3 years for governance and audit purposes, then deleted. |
Temporary case discussion notes | Working documents used to facilitate Hub discussions, typically anonymised summaries. | Held securely during meetings (physical or electronic) and controlled by the coordinating officer. | Destroyed immediately after the meeting or once formal minutes are confirmed. |
Identifiable referral information | Personal data shared between organisations following Hub discussion to enable support. | Transferred via secure channels (e.g. encrypted email) and stored within receiving organisation systems. | Retained in line with the receiving organisation’s retention schedule for case records (e.g. 6–8 years depending on service). |
Case records held by LCC services | Detailed records where LCC is directly involved in providing support. | Stored within core LCC case management systems with strict access controls. | Retained in line with statutory service-specific retention periods (typically 6–8 years after case closure, longer where safeguarding applies). |
Email correspondence (Hub coordination) | Emails between partners relating to coordination, referrals, and meeting activity. | Stored within secure corporate email system with access controls. | Retained for up to 3 years, or migrated into formal records where required, then deleted in line with retention schedules. |
AI-generated outputs (summaries, drafts) | Outputs created using approved AI tools to support administration and reporting. | Stored within secure LCC environment and only where saved as formal records. | Retained only where forming part of official records; otherwise deleted after use or within 12 months. |
Internal Armed Forces staff network contact list | Details of LCC staff who opt in to the internal network. | Stored within secure LCC systems with restricted access. | Reviewed annually; removed upon request or where no longer relevant. |
Data sharing agreements / governance documentation | Formal documentation setting out roles, responsibilities and data sharing arrangements. | Stored securely with controlled access. | Retained for duration of Hub operation and for 6 years after termination for audit purposes. |
Your rights
You have certain rights under the UK General Data Protection Regulation (UK GDPR), these are those rights:
to be informed via Privacy Notices such as this.
to withdraw your consent. If we are relying on your consent to process your data, then you can remove this at any point.
of access to any personal information the council holds about yourself. To request a copy of this information you must make a subject access request in writing. You are entitled to receive a copy of your personal data within 1 calendar month of our receipt of your subject access request. If your request is complex then we can extend this period by a further two months, if we need to do this, we will contact you. You can request a subject access request, either via a letter or via an email to Information Governance Team, address below.
of rectification, we must correct inaccurate or incomplete data within one month.
to erasure. You have the right to have your personal data erased and to prevent processing unless we have a legal obligation to process your personal information.
to restrict processing. You have the right to suppress processing. We can retain just enough information about you to ensure that the restriction is respected in future.
to data portability. We can provide you with your personal data in a structured, commonly used, machine readable form when asked.
to object. You can object to your personal data being used for profiling, direct marketing or research purposes.
in relation to automated decision making and profiling, to reduce the risk that a potentially damaging decision is taken without human intervention.
If you want to exercise any of these rights, then you can do so by contacting:
Information Governance Team
Lancashire County Council
PO Box 78
County Hall
Preston
PR1 8XJ
Email: dpo@lancashire.gov.uk
To ensure that we can deal with your request as efficiently as possible you will need to include your current name and address, proof of identity (a copy of your driving licence, passport or two different utility bills that display your name and address), as much detail as possible regarding your request so that we can identify any information we may hold about you, this may include your previous name and address, date of birth and what council service you were involved with.
Identity and contact details of the data controller
Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ
Contact details of the data protection officer
Our Data Protection Officer is Joanne Winston. You can contact her at dpo@lancashire.gov.uk or Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ
Further information
For more information about how we use personal information see Lancashire County Council's full privacy notice.
If you wish to raise a complaint on how we have handled your personal data, you can contact the Information Governance team who will investigate the matter.
Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ or email: dataprotection@lancashire.gov.uk
If you are not satisfied with our response or believe we are processing your personal data not in accordance with the law you can complain to the Information Commissioner’s Office (ICO).