Privacy notice relating to the processing of employee personal data by Rhondda Cynon Taf County Borough Council for health and safety purposes when using the StaySafe Application.
This privacy notice is intended to provide information about how the Council will use (or ‘process’) employee personal data for health and safety purposes when using the StaySafe Application (or ‘app’).
This notice should be read in conjunction with;
- Lone Working Policy
- Any departmental protocols relating to the use of the StaySafe app.
Please note, some services may use the StaySafe App for other purposes. Separate privacy notices are provided in this regard. Please speak to your Line Manager to confirm the purpose for which the App is used within your Service.
Introduction
Our employees, in particular lone workers and those that work in the community may be at risk from accidents, injury, and violence whilst at work. As an employer, we have a duty of care to ensure that our employees are safe whilst at work, when travelling during the working day and meeting with clients alone or in remote locations.
The use of the StaySafe App by the Council provides visibility of the location and safety status of our employees. The App is installed on the employees mobile phone providing an option to raise an alarm in the event there is a risk to their safety, are uncomfortable in a certain area or need emergency assistance.
Location tracking only commences when the employee checks into the App and ends when they check out. Employees are in complete control of when their location is tracked to ensure their privacy
is maintained, for example during lunch breaks and when travelling home at the end of the working day.
The Data Controller
The Council is the data controller for the personal data processed when using the StaySafe App.
The Council is registered with the Information Commissioner’s Office (ICO) as a controller under reference Z4870100.
The Data Protection Officer
The Councils Data Protection Officer (DPO) can be contacted in relation to data protection matters.
Should you have the need to contact the Data Protection Officer directly you can do so via email at Information.management@rctcbc.gov.uk.
Queries relating to this privacy notice
If you have any questions or queries relating to this privacy notice and the use of the StaySafe App please contact your Line Manager in the first instance.
The categories of personal data we process
When an employee uses the StaySafe application the following personal data is processed:
- Biometric data – if the employee uses this method to authenticate access to the App
- Employee location data captured via the apps GPS including time/date
- Employee personal identifiers such as name, job role, mobile phone number etc.
In addition, we process and provide the following information to StaySafe in order for their call handlers to respond to an emergency alarm activation:
- Health data if staff have known relevant medical condition that StaySafe need to be aware of (Managers will discuss this with the employee before providing the information)
- Next of kin / family member name and contact number
In the event of an alarm being activated, we may also process the following information:
- Time, date and nature of the emergency
- Action taken
- Outcome etc.
- Vehicle registration number in the event of a road traffic accident
Why we process the personal data
We use the StaySafe application and process the personal data to ensure the health and safety of our employees. This may include the following activities:
-
- Enabling the employees use the App (account creation, management etc.)
- Ensuring the employee is using the App correctly i.e. how and when they should be etc.
- Determine the whereabouts of employees when checked in to the app
- Responding to an emergency situation in the event of the panic alarm being activated
- Recording / reporting an incident (in the event of the panic alarm being activated)
Our lawful basis for processing the personal data
Under the General Data Protection Regulation (GDPR), our lawful basis for processing the personal data for health and safety purposes when using the StaySafe application is:
- Legal Obligation (c) – processing is necessary for compliance with a legal obligation to which the controller is subject.
- Employment, Social Security and Social Protection Law – Article 9 (2)(b) – processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law in so far as it is authorised by Union or Member State law or a collective agreement pursuant to Member State law providing for appropriate safeguards for the fundamental rights and the interests of the data subject.
The primary legislation, regulations and guidance that supports this includes, but is not limited to;
Who or where we get the personal data from
We obtain the personal data directly from employees when they use the StaySafe App.
We may also receive information from StaySafe e.g. in the event that their call handler respond to an alarm activation.
Who we share personal data with
The personal data captured when using the StaySafe Application is accessed by and may be shared with:
|
Who
|
Purpose
|
|
Employees Line Manager / Management Team etc.
|
Health and safety purposes.
|
|
StaySafe Call Handlers
|
To respond to any panic alarm raised via the StaySafe App e.g., to provide assistance, alert the emergency services etc.
|
|
Emergency Services
|
To provide necessary support in the case of an emergency / report any incidents.
|
|
Next of Kin / Emergency Contact
|
In the case of an emergency
|
When sharing the personal data, we only share the minimum amount necessary in relation to the purpose.
Data Processors
A data processor is a company or organisation that processes personal data on our behalf. Our data processors act only upon our instruction. They cannot do anything with the personal data unless we instruct them to do so. They will not share the personal data with any organisation apart from us or use it for their own purposes. They will hold it securely and retain it for the period we instruct.
StaySafe Apps Limited is the data processor for the personal data processed via the StaySafe Application and when responding to alarm activations via the App.
How long we retain the personal data
We retain the personal data captured via the StaySafe App for the following time period:
|
Purpose
|
Length of time / trigger
|
Reason
|
|
Health & Safety – business need
|
1 year from the date the data is captured – if no reportable accident or incident occurs.
|
Business need.
Please note, in the event of a reportable accident or incident, the data may be kept for up to 7 years for that purpose.
|
In keeping with the General Data Protection Regulation storage limitation principle, records are periodically reviewed
Your data protection rights
The General Data Protection Regulation (GDPR) gives individuals important rights, including the right of access to the personal data that the Council holds about you.
Click here for further information on your information rights and how to exercise them.
Your right to make a data protection complaint to the Council
You have the right to complain to the Council if you believe we have not handled your personal data responsibly and in line with good practice.
If you have any concerns about the processing of your personal data via the StaySafe App you should contact your Line Manager in the first instance.
Your right to make a data protection complaint to the ICO
You also have the right to complain to the ICO if you are unhappy with how we have used your data. However, we encourage you to contact us first and provide us with an opportunity to look into your concern and put things right.
The ICO can be contacted:
- Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
- Helpline number: 0303 123 1113
Website: https://www.ico.org.uk