Complaints privacy notice

When you make a complaint, you will need to provide us with some personal data or information.

As the 'data controller' for the personal information - or data - we hold about you, South Ayrshire Council decides how your personal information is used/processed and what it is used for.

This statement provides more details about this and provides information on how to get in touch with us if you need to know more.

Your personal data - what is it?

Personal data is information relating to a living person who can be identified from that data. Identification can be based on the information alone, or in conjunction with any other information. The processing of personal data is governed by the General Data Protection Regulation 2016 (GDPR) and supplemented by the Data Protection Act 2018.

What Personal Data will we collect from you?

We will only collect the personal data we need to provide you with relevant information, services and support. The personal data we may collect includes:

• Name
• Address
• Email
• Telephone number (landline/mobile)
• Personal data you provide us with relating to your complaint (this may include, for example, your National Insurance number or health information depending on the nature of your complaint)

We will log and keep your personal data on our Complaints Handling paper records, electronic filing and computer systems.

How will we use your information?

All personal data is processed only by our Complaints Handling staff as part of the complaints handling process. We will only collect the personal data we need in order to provide you with access to Council's Complaints Handling service, and oversee the provision of this service to you. We will use this personal data to contact you; to clarify any issues we have with your Complaint; to undertake our complaint investigation and to provide our response. We may use your email address following resolution of your complaint to elicit feedback on how we can improve our complaints process. Any feedback you chose to give is provided anonymously.

What is the legal basis for using/sharing your information?

Processing is necessary under the terms of GDPR for the performance of a public service provided by the Council, i.e. to provide you with the Council's Complaints Handling service.

Special category data

For some complaints you may need to provide us with more sensitive personal information about you known as special category data, for example health information. The processing of this information is necessary for reasons of substantial public interest as set out in the Data Protection Act 2018. It is necessary for us to process this more sensitive to carry out key functions as set out in law

Who will we share your information with?

Our Corporate Complaints Handling team will share your name, address, email, telephone number and details of your complaint internally with designated complaints co-ordinators and investigating staff within services to allow them to allocate, investigate respond to a complaint made. Your information may also be shared with Senior Council officers and investigators should you request your complaint be escalated to a Stage Two investigation, or the Scottish Public Services Ombudsman (SPSO) to assist with its investigation into the Council's handling of your complaint if you have requested it do so.

How long do we keep hold of your information?

We keep your personal data for no longer than reasonably necessary. When you make a comment or general enquiry to the Council we will retain this for the current year plus one further year, from the last action on our file. If you make a complaint at Stage 1, Stage 2 or seek a Scottish Public Services Ombudsman investigation we will retain our records for the current year plus 5 further years following the last action on the complaint investigation.

What are your rights?

The lawful basis for processing/using your personal data directly impacts which rights are available to you. For example, some rights will not apply, in this case we are not required to:

• Erase your personal information.
• Enable the right to data portability

However, you do have the following rights and can ask us to:

• Correct your personal information if it is inaccurate;
• Complete your personal information if it is incomplete;
• Restrict the processing of your personal information in certain circumstances You also have the right to object to the processing of your personal information.

What are the consequences of failing to provide personal information?

While there is no requirement for you to provide your personal information when making a complaint, in the event you chose not to provide this the Council will be unable to provide you with a response to your complaint and maybe unable to fully investigate any issues you have raised regarding a Council service.

Do you require this statement in a different format?

Please contact us if you require this information in an alternative format.

How can you get in touch with us?

If you wish to obtain any records held by the Council relating to you, or if you have any general data protection queries, please contact the Council's Data Protection Service at:

Data Protection Officer
South Ayrshire Council
County Buildings
Wellington Square
Ayr
KA7 1DR

Email: DataProtection@south-ayrshire.gov.uk
Telephone: 01292 612 223

If you have a complaint

If you are unhappy with the way the Council has dealt with your personal information, you can complain to the Data Protection Officer using the contact details noted above. If you remain dissatisfied, you have the right to complain to the Information Commissioner:

Information Commissioner's Office
45 Melville Street
Edinburgh
EH3 7HL

Email: scotland@ico.org.uk
Telephone: 0303 123 1113

If you have no internet access

Please contact us at the above postal address or telephone number if you wish to have copies of any of the above information and you do not have access to the internet. We will endeavour to let you have hard copies of the information.