Privacy notice relating to the processing of personal data by Rhondda Cynon Taf County Borough Council for the purpose of the provision of Medically Prescribed Diets.
Introduction
This privacy notice is intended to provide information about how Rhondda Cynon Taf County Borough Council (referred to as ‘RCTCBC’, ‘Council’, ‘Local Authority’, ‘we’) will use (or ‘process’) personal data about individuals for the purpose of Catering Services Medically Prescribed Diets provision.
This notice should be read in conjunction with;
- The Council’s corporate privacy notice
The Data Controller
The Council is the data controller for the personal data processed for the purposes of Catering Services Medically Prescribed Diets provision.
The Council is registered with the Information Commissioner’s Office (ICO) as a controller under reference Z4870100.
Queries relating to this privacy notice
If you have any questions or queries relating to this privacy notice please contact the Catering Services Team:
By email : cateringservices@rctcbc.gov.uk
By telephone : 01443 281141
In writing : Catering Services, Valleys Innovation Centre, Navigation Park, Mountain Ash, CF45 4SN
Who we are what we do
The Council’s Catering Services aims to improve food and nutrition in our schools to strengthen pupil’s health and wellbeing and raise standards of learning and attainment for our pupils. As part of this service we cater for pupils with medically prescribed dietary requirements. The service consists of:
- Referrals will come directly from the pupil’s parent / carer via an on-line portal.
- Administrative Support Service – who work closely with the schools catering teams to ensure those involved with on site pupil supervision are informed of the pupil’s medical dietary needs.
- School Catering Staff – who prepare, cook and distribute the meals (including breakfast club staff and dining room Supervisors).
Whose personal data we process
We process personal data relating to the following individuals to enable the service to provide appropriate support for medically prescribed diets:
- Pupil Name, School, school year (at the point of application), and pupil date of birth.
- Parent / carer contact details, including name, address, telephone number and email address.
- Health information such as evidence from a medical professional which states the dietary restrictions that must be adhered to to protect the pupil.
The categories of personal data we process
We process the following categories of personal data to identify the individuals we cater for with medically prescribed diets (and their next of kin):
- Name
- Date of Birth
- Address & postcode
- Contact information, email and telephone number
- Name of child’s school
- Health, such as evidence from medical prefessionals and prescribed medication
Why we process the personal data
We process the personal data to to enable us to identify the pupil, and provide appropriate catering to meet their medically prescribed dietary needs. This may include but is not limited to the following activities;
- To provide the pupil with a meal that is to their choice and dietary requirements.
- To ensure the safeguarding and wellbeing of the pupil in terms of providing food which is suitable for their dietary needs.
Our lawful basis for processing the personal data
Under the General Data Protection Regulation (GDPR), our lawful basis for processing the personal data to Catering Services Medically prescribed diets is;
- Legal Obligation 6 (c) – processing is necessary for compliance with a legal obligation to which the controller is subject.
- Public Task - Article 6 (e) – processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
- Substantial public interest - Article 9 (2) (g) - processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law, which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.
- Schedule 1, Part 2, Statutory & Government Purposes - Data Protection Act 2018
The primary legislation, regulations and guidance that supports this includes, but is not limited to;
- Healthy Eating in Maintained Schools Regulations 2014.
Who or where we get the personal data from
We may receive the personal data from the following categories of individuals or organisations;
- The pupil’s parents or carer
- The pupil’s School
- Dietary and allergy information from a medical professional
Who we share personal data with
We may share the personal data with the following key organisations to support the health and wellbeing of the pupil.
When sharing the personal data, we only share the minimum amount necessary in relation to the purpose.
|
Who
|
Purpose
|
|
Central Catering Team
|
To enable the creation and implementation of menus which are suitable for consumption by the pupil who identifies as requiring a Medically prescribed diet.
|
|
Schools Staff
|
To enable identification of the pupil to provide food that meets their medically prescribed dietary needs, and to provide the appropriate medical response in the event that the pupil consumes or comes into contact with any food which causes them an adverse reaction.
|
|
Food Production and Service Teams within the School
|
To enable identification of the pupil to provide food that meets their medically prescribed dietary needs, and to provide the appropriate medical response in the event that the pupil consumes or comes into contact with any food which causes them an adverse reaction
|
Data Processors
A data processor is a company or organisation that processes personal data on our behalf. Our data processors act only upon our instruction. They cannot do anything with the personal data unless we instruct them to do so. They will not share the personal data with any organisation apart from us or use it for their own purposes. They will hold it securely and retain it for the period we instruct.
The categories of data processors we use are:
- IT system suppliers
How long we retain the personal data
We retain the personal data contained within Catering Services for:
|
Length of time
|
Reason
|
|
We will keep personal information until the pupil leaves school plus 1 year.
|
For any queries and transition of pupil records
|
In keeping with the General Data Protection Regulation storage limitation principle, records are periodically reviewed. Not all personal data is retained. Only personal data that is relevant to the record is retained for the entire retention period. Information that has no long term or evidential value is routinely destroyed in the normal course of business.
Your data protection rights
The General Data Protection Regulation (GDPR) gives individuals important rights, including the right of access to the personal data that the Council holds about you.
Click here for further information on your information rights and how to exercise them.
Your right to make a data protection complaint to the Council
You have the right to complain to the Council if you believe we have not handled your personal data responsibly and in line with good practice.
You can do this by contacting Catering Services directly via one of the following communication methods. Most concerns can be resolved relatively quickly through a simple phone call or email;
- Email : cateringservices@rctcbc.gov.uk
- Telephone : 01443 281141
- In writing : Catering Services, Valleys Innovation Centre, Navigation Park, Mountain Ash, CF45 4SN
Alternatively, you can raise a formal complaint via the Council’s Customer Feedback Scheme using the following link (Make a comment, compliment or complaint online) or you can contact the Council’s Data Protection Officer at Information.management@rctcbc.gov.uk.
Your right to make a data protection complaint to the ICO
You also have the right to complain to the ICO if you are unhappy with how we have used your data. However, we encourage you to contact us first and provide us with an opportunity to look into your concern and put things right.
The ICO can be contacted:
- Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
- Helpline number: 0303 123 1113
- Website: https://www.ico.org.uk