Facilities Management
To comply with the UK General Data Protection Regulation (UK GDPR), where personal data relating to a data subject is collected, Lancashire County Council would like to provide you with the following details.
Identity and contact details of the data controller
- Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ
Contact details of the data protection officer
- Our Data Protection Officer is Joanne Winston. You can contact her at dpo@lancashire.gov.uk or Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ
Reasons for processing your personal data
The Lancashire County Council Facilities Management Service (FM Service) is responsible for planning, allocating and managing the Council's office accommodation including, premises management, reception services, repairs and maintenance, and the day-to-day management of all corporate office accommodation. The service also works with the Property Service to assess office accommodation needs across the county.
Your personal data may be used so that the FM Service can deliver the following functions.:
- Car park management
- Meeting and conference room booking management
- Office and furniture equipment provision
- Access control and ID badge management
- Visitor management
Legal basis for processing personal data
The legal basis for processing your personal data, in accordance with the UK GDPR Article 6 is:
(c) Legal Obligation: the processing is necessary for us to comply with the law. We will cite the applicable legislation if we need to rely on this basis for processing.
The service will process personal data because it has a legal obligation to do so. This will be by virtue of the following legislation:
- Health and Safety at Work Act (1974)
(f) Legitimate Interests: pursued by us or by a third party.
Legal basis for processing special categories of personal data
The legal basis for processing special categories of personal data relating to you, in accordance with the UK GDPR Article 9 is:
(g) Processing is necessary for reasons of substantial public interest.
We may be required to process your special category personal data in order to effectively deliver our services.
Where we do so we rely on Substantial Public Interest by virtue of the following legislation:
- Data Protection Act (2018) Schedule 1 Part 2 (8) Equality of opportunity or treatment
- Data Protection Act (2018) Schedule 1 Part 2 (16) Support for individuals with a particular disability or medical condition
Information we process about you
The personal data we collect might include the following:
- Full name
- Email address
- Work address
- Work contact telephone number
- Payroll number
- Work I/D badge number
- Blue badge serial number (if applicable)
- AD log on name
- Vehicle details (vehicle registration number)
- Contact details
- Relevant medical condition
If necessary, we might also collect what is called ‘special category’ data – that is, sensitive information such as medical/health information.
We will also process CCTV footage as part of our activities – for specific details of how we handle CCTV data please see our CCTV privacy notice.
Recipients of the personal data that we process about you
If necessary, we might share your personal data with other agencies and authorities, depending on the service being provided. We will only share your personal data if it is necessary to do so, and the appropriate conditions have been met.
In general, the external bodies with whom we share information might include:
- Police
- Courts
- Solicitors
- Contractors
Personal data also might be shared between Lancashire County Council services,
Any transfers to another country
- Yes – we use a system called Matrix to handle room bookings. The provider of this system processes personal data in the EU and in the USA.
Lancashire County Council will always ensure that any such processing of your personal data outside of the UK complies with UK GDPR.
Retention periods
Lancashire County Council will only store your information for as long as is legally required or in situations where there is no legal retention period they will follow established best practice.
| File type | Description | Security | Retention period |
|---|---|---|---|
| Meeting Room and Touchdown space booking entry details | Details captured on our Matrix platform in support of us administering space bookings in our buildings | The system always ensures encryption and security of personal data. | 24 months from date of booking |
| Visitor Car Park booking | Details captured on our Matrix platform in support of us administering space bookings in our buildings | The system always ensures encryption and security of personal data | 24 months from date of booking |
| Access Control Information | Information stored within LCC hosted TDSi ExGarde database for purpose of controlling access to buildings | The system is subject to LCC Digital Services network security protocols, with system access controlled to authorised account holders only. | Access control usage data is retained for 12 months. User details are suspended on employment termination and are deleted after 12 months. |
| ID badge details | Information stored within LCC hosted Badgemaker database for the creation of staff ID badges, including name, photo, and directorate. | The system is subject to LCC Digital Services network security protocols, with system access controlled to authorised account holders only. | Information is retained until termination of employment is confirmed, after which it is deleted. |
| Visitor logbooks | Visitor name, organisation, and contact number are held as digitised paper records | Digitised (scanned) records are stored within LCC Digital Services network folders that are subject to controlled access | 24 months from date of visit |
Your rights
You have certain rights under the UK General Data Protection Regulation (UK GDPR), these are those rights:
- to be informed via Privacy Notices such as this.
- to withdraw your consent. If we are relying on your consent to process your data, then you can remove this at any point.
- of access to any personal information the council holds about yourself. To request a copy of this information you must make a subject access request in writing. You are entitled to receive a copy of your personal data within 1 calendar month of our receipt of your subject access request. If your request is complex then we can extend this period by a further two months, if we need to do this, we will contact you. You can request a subject access request, either via a letter or via an email to Information Governance Team, address below.
- of rectification, we must correct inaccurate or incomplete data within one month.
- to erasure. You have the right to have your personal data erased and to prevent processing unless we have a legal obligation to process your personal information.
- to restrict processing. You have the right to suppress processing. We can retain just enough information about you to ensure that the restriction is respected in future.
- to data portability. We can provide you with your personal data in a structured, commonly used, machine readable form when asked.
- to object. You can object to your personal data being used for profiling, direct marketing or research purposes.
- in relation to automated decision making and profiling, to reduce the risk that a potentially damaging decision is taken without human intervention.
If you want to exercise any of these rights, then you can do so by contacting:
Information Governance Team
Lancashire County Council
PO Box 78
County Hall
Preston
PR1 8XJ
Email: dpo@lancashire.gov.uk
To ensure that we can deal with your request as efficiently as possible you will need to include your current name and address, proof of identity (a copy of your driving licence, passport or two different utility bills that display your name and address), as much detail as possible regarding your request so that we can identify any information we may hold about you, this may include your previous name and address, date of birth and what council service you were involved with.
Further information
- If you would like more information about this specific service, then please contact the FM Service via email at askfm@lancashire.gov.uk or by post by writing to Facilities Management Service, Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ
For more information about how we use personal information see Lancashire County Council's full privacy notice.
If you wish to raise a complaint on how we have handled your personal data, you can contact the Information Governance team who will investigate the matter.
Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ or email: dataprotection@lancashire.gov.uk
If you are not satisfied with our response or believe we are processing your personal data not in accordance with the law you can complain to the Information Commissioner’s Office (ICO).