Business support grant (COVID-19) privacy notice

This privacy statement has been developed in response to coronavirus (COVID-19) pandemic to inform you how we will use your personal information when you apply for funding from the Coronavirus Support Fund.

Who we are

As the 'data controller' for the personal information - or data - we hold about you, South Ayrshire Council decides how your personal information is used/processed, and what it is used for.

Your personal data - what is it?

Personal data relates to a living individual who can be identified from that data. Identification can be by the information alone or in conjunction with any other information. The processing of personal data is governed by the General Data Protection Regulation 2016 (GDPR) and supplemented by the Data Protection Act 2018.

The UK Independent Regulator of data protection law, the Information Commissioner's Office (ICO) has issued specific guidance for the processing of personal data during COVID-19.

What information we collect from you?

You are giving us your personal information to allow us to determine whether your business is eligible to receive funding from the Coronavirus Support Fund, and to administer that funding to your business. We also use your information to verify your identity where required, contact you by post, email or telephone and to maintain our records. This local authority is administering the Scottish Government Coronavirus Business Support Fund.

How we will use the information about you?

We are collecting your personal data for the following purposes:

• To correctly assess your eligibility to receive funding from the Coronavirus Support Fund
• To protect public funds, including the prevention and detection of crime or fraud

What is the legal basis for processing (using) your personal data?

How we are sharing/using your personal data will determine the legal basis the Council is relying on which is:

The processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract as per Article 6(1)(b) of the GDPR.

If you do not provide us with the information we have asked for then we will not be able to provide this service to you.

Who we share your information with?

We are legally obliged to safeguard public funds so we are required to verify and check your details internally for fraud prevention.

We may share this information with other public bodies (and also receive information from these other bodies) for fraud checking purposes. We are also legally obliged to share certain data with other public bodies, such as other local authorities or HMRC and will do so where the law requires this. In order to meet our legal obligations and to promote openness and transparency around the use of public funds.

Grant recipients should be aware that details of these payments may be disclosed. This disclosure may include:

• the name of the payee
• the date
• the sum
• the subject of the payment.

We will also generally comply with requests for specific information from other regulatory and law enforcement bodies where this is necessary and appropriate. Your information is also analysed internally to help us improve our services. This data sharing is in accordance with our Information Use and Privacy Policy and covered in our full privacy statement on our website. It also forms part of our requirements in line with our Records Management Plan approved in terms of the Public Records (Scotland) Act 2011.

Your information will be shared with the Scottish Government for the purposes of determining your application and administering it. The Scottish Government or individual local authorities may publish a full list of properties against which either a small business grant or a retail, hospitality and leisure grant has been paid.

How long do we keep hold of your information?

We only keep your personal information for the minimum period amount of time necessary. Sometimes this time period is set out in the law, but in most cases it is based on the business need.

We will not keep your information for any longer than it is needed once the pandemic is over.

What are my rights?

There are no fundamental changes to your data protection rights.

The lawful basis for processing/using your personal data directly impacts which rights are available to you. For example, some rights will not apply, when we are processing your information under contract (Article 6 (1) (b)) you do not have the right:

• to object to the processing of your personal information or
• not to be subject to a decision based solely on automated processing

However, you do have the following rights and can ask us to:

• erase your personal information
• data portability
• provide access to your information
• correct your personal information if it is inaccurate;
• complete your personal information if it is incomplete
• restrict the processing of your personal information in certain circumstances.

Information you have given us about other people

If you have provided anyone else's details on this form, please make sure that you have told them that you have given their information to South Ayrshire Council. We will only use this information to process and administer your claim. If they want any more information on how we will use their information they can visit our website or email at DataProtection@southayrshire.gov.uk.

Do you require this statement in a different format?

Please contact us if you require this information in an alternative format.

How can I access the information you hold about me?

If you wish to obtain any records held by the Council relating to you, or if you have any general data protection queries, please contact the Council's Information Governance Team at:

Information Governance
South Ayrshire Council
County Buildings
Wellington Square
Ayr
KA7 1DR

Email: DataProtection@south-ayrshire.gov.uk
Telephone: 01292 612 223

If you have a complaint

If you are unhappy with the way the Council has dealt with your personal information, you can complain to the Data Protection Officer using the contact details noted above.If you remain dissatisfied, you have the right to complain to the Information Commissioner (https://ico.org.uk/for-the-public/):

Information Commissioner's Office
45 Melville Street
Edinburgh
EH3 7HL

Email: scotland@ico.org.uk
Telephone: 0303 123 1113

If you have no internet access

Please contact us at the above postal address or telephone number if you wish to have copies of any of the above information and you do not have access to the internet. We will endeavour to let you have hard copies of the information.