Privacy and cookies

Commercial Services privacy notice

How your personal Information is used by Commercial Services

Here at Midlothian Council, we take your privacy seriously. Under the Data Protection Act 2018, you have a right to know how we collect, use and share your personal data. The information below provides a general description of the kinds of personal data we collect in Commercial Services and how we might use and share it.

You can find more detailed information about how and why we use your data in individual Privacy Notices, which we issue when we collect your data. The information we collect will depend on the work we need to do, or the service you get from us. Specific information about how we use your personal data is covered in service-specific privacy notices (as they become available):

Service-specific privacy notices

• Land and Countryside Services (PDF)
• Road Services (PDF)
• Travel and Fleet Services (PDF)
• Waste Services (PDF)
• Risk, Safety and Civil Contingencies (PDF)

Our Privacy Promise

We promise to collect, process, store and share your data safely and securely.

What lets us collect your information?

We have a legal duty to provide some Commercial Services. When we do this we are generally working under the following legislation:

• Burial and Cremation (Scotland) Act 2016
• Scottish Public Services Ombudsman Act 2002
• Health and Safety at Work etc. Act 1974
• Social Security Act 1998
• Fire (Scotland) Act 2005
• Civil Contingencies Act 2004 (Contingency Planning) (Scotland) Regulations 2005
• Roads (Scotland) Act 1984
• New Roads and Street Works Act 1991
• Road Traffic Act 1988
• Disabled Persons’ Parking Places (Scotland) Act 2009
• Disabled Persons’ Parking Badges (Scotland) Act 2014
• National Bus Travel Concession Scheme for Older and Disabled Persons (Scotland) Order 2006 as amended in 2013, 2015 and 2017
• Environmental Protection Act 1990
• Social Security (Claims and Payments) Regulations 1979
• Reporting of Injuries, Diseases and Dangerous Occurrence Regulations 2013
• Local Government (Scotland) Act 1973
• Local Government (Scotland) Act 1975
• Local Government etc. (Scotland) Act 1994

What kinds of personal data do we collect?

The personal data we collect might include your name, date of birth, address, National Insurance number, or other information that identifies you.  If necessary, we might also collect what is called ‘special category’ data – that is, sensitive information such as medical/health information. We will always make it clear what information we are collecting, how we will use it, and why and with whom we will share it through a service-specific Privacy Notice.

How do we collect your personal data?

We collect your personal data in many different ways. You might give us your personal data yourself, by entering your information in a form on the Council website or by contacting a Council officer in person, in writing or over the phone. We might also receive your personal data from other agencies or local authorities. If we share information regularly with another organisation, the conditions for sharing your personal data are set out in an Information Sharing Agreement.

How do we use your personal data?

Your personal data may be used so that Commercial Services can deliver its main functions. These functions include providing services for adults in the following categories:

• Road Services
• Waste Services
• Travel and Fleet Services
• Risk, Safety, Health and Civil Contingencies
• Land and Countryside Services

Specific information about how we use your personal data is covered in service-specific Privacy Notices.

Why do we share your personal data?

We might share your personal data in order to effectively deliver our services.  This might be because another agency or contractor has been contracted to provide a service, or because responsibility for particular services is shared across multiple agencies or authorities, such as home to school transport.

We will share your personal data where there is a statutory obligation for us to do so, for example in the case of complying with the Reporting of Injuries, Diseases and Dangerous Occurrence Regulations.

Specific information about how and why your personal data is shared is covered in service-specific Privacy Notices.

With whom do we share your personal data?

If necessary, we might share your personal data with other agencies and authorities, depending on the service being provided. We will only share your personal data if it is necessary to do so, and the appropriate conditions have been met.

In general, the external bodies with whom we share information might include:

• Other Local Authorities
• Central government or government agencies
• Regulators
• Police
• Courts
• Solicitors
• Third sector partner organisations
• Contractors
• Councillors

Personal data also might be shared between Midlothian Council services, including Schools.

Specific information about other bodies with whom we share your personal data is covered in service-specific Privacy Notices.

How long do we keep your personal data?

Your personal data is kept in line with Midlothian Council’s Retention Schedule. The retention schedule sets out the kinds of information the Council creates and uses, how long it should be kept, and what should be done with it at the end of its ‘life’.

• Our retention schedule (Excel)

Further information

You can find out more about how we use your information to detect and prevent fraud or crime, information collected through our website, recorded telephone calls, CCTV, the rights you have under the Data Protection Act, and how to contact us by referring to the overarching Midlothian Privacy Notice.