We collect and process personal data relating to staff and councillors who work in our offices and visitors to our buildings. We are committed to being transparent about how we collect and use this data and meet our data protection obligations.
What information do we collect?
We receive and process basic information about staff and councillors. This includes:
- your name, job title, department and HR staff reference number
- your picture
- your location
We receive this information from the Human Resources Department and from the relevant departmental managers.
The picture is taken by the FM Department to display on the access cards and our electronic phonebook. Your location will be recorded when the access cards are used.
We also request the name and relevant personal details from visitors to our buildings.
Why do we process personal data?
We have a legitimate interest in making our buildings secure and recording who had access. Access into the Civic Centre from outside and internal circulation is controlled by magnetic locks which are released by staff access cards.
Therefore, the information is necessary to produce, issue and manage swipe cards for access to the Civic Centre and enable staff to print documents.
Who has access to data?
The data system can be accessed by:-
- Facilities Management staff
- Safer Runnymede
- ICT Department
- Managers and HR for disciplinary or health and safety purposes in accordance with our policies.
How do we protect data?
We take the security of your data seriously. The organisation has internal policies and controls in place to ensure that your data is not lost, accidentally destroyed, misused or disclosed, and is not accessed except by its employees in the performance of their duties. Data will only be processed by members of staff authorised by us for this purpose. Access to our systems is limited to members of the teams noted above, whose job role requires access to the personal data.
For how long do we keep data?
Information is kept on each individual staff member for the duration of their employment. Once the staff member has left, the data will be removed.
We destroy visitor sign in records after 21 days.
As a data subject, you have a number of rights. You can:
- access and obtain a copy of your data on request (known as a subject access request)
- require us to change incorrect or incomplete data;
- ask us to delete or stop processing your data, for example where the data is no longer necessary for the purposes of processing. Where possible we will seek to comply with your request, but we may be required to hold or process information to comply with a legal requirement.
- object to the processing of your personal data in certain circumstances. We may still be required to hold or process information if there are legitimate grounds for doing so.
You can make a subject access request by following the instructions for making a subject access request.
To contact us about any of your other data protection rights, please contact the Data Protection Officer.
If you believe that Runnymede Borough Council has not complied with your data protection rights, you should initially contact our Data Protection Officer and if dissatisfied with the outcome you can make a complaint to the Information Commissioner. You can find out further information on making a complaint to the Information Commissioner on their website.