Your Notts Directory privacy notice

Introduction

This privacy notice explains how Nottinghamshire County Council use your personal data in the operation of the Your Notts Directory.

The Your Notts Directory is a partnership project between Nottinghamshire County Council and Nottingham City Council.

The shared Your Notts Directory provides publicly accessible information about community groups, local services, events, and organisations operating within the two local authority areas. This assists the council to meet its statutory duty to help residents, professionals, and partner organisations find accurate, up-to-date information about local advice and support.

To maintain this directory, we collect and publish information provided by service providers, community groups, regulatory bodies and other authorised contributors.

Who will be using your data?

Your Notts Directory is a shared directory developed and administered by Nottinghamshire County Council and Nottingham City Council who work together as joint data controllers. This means the two councils jointly manage how the directory works and how information is used, even though each council manages its own local provider information day-to-day.

Under UK GDPR, joint data controllers must set out in a transparent manner how they will meet their obligations. Nottinghamshire County Council and Nottingham City Council have a written agreement which sets out how responsibilities are divided and how compliance with data protection law is ensured.

The agreement ensures that both authorities:

have clear and transparent responsibilities
meet their legal obligations under the UK GDPR and Data Protection Act 2018
maintain accuracy and governance of directory content.

Although this arrangement allocates responsibilities between the authorities, you may exercise your data protection rights against either council where your personal data is jointly controlled and both will work together to ensure your request is handled appropriately.

We may contract third party organisations to process your data on our behalf (e.g. suppliers of business systems and the supplier of the Your Notts Directory).

Some service providers may choose to add photographs or testimonials which contain personal or special category data to their listing on the directory. When this happens, the service provider is the data controller of this, and they are responsible for managing consent and your data subject rights in respect of this.

What personal data do we use?

name
email address
telephone number
address
other ID or registration numbers such as CQC or Ofsted
IP address.

We will also collect and use organisation or service details, including descriptions of activities, locations, eligibility criteria, accessibility information, accreditations, registration details and inspection outcomes relating to Ofsted and CQC.

What types of special category personal data do we need from you?

The council does not directly collect or process special category data. However, service providers may upload testimonials, images or other content that may include special category data about individuals. In these cases, the provider is the data controller for that content.

We also process data about criminal convictions, criminal offences or related security measures. This is in relation to service providers who self-declare that they have had a DBS check. This information is volunteered by these individuals.

Why do we use your personal data?

to provide information about childcare provision, including the provision of free childcare places and other services or facilities that may be of benefit to parents, prospective parents, children or young persons
to support childcare providers with training and the administration of free childcare places
to establish and maintain a service for providing people in the area with information and advice relating to care and support for adults and support for carers
market shaping and commissioning of care and support
to provide information for children and young people with special educational needs and or disabilities, including provisions about special education, health and social care
for service delivery
for service planning, training and improvement
for research purposes.

What legal reasons allow us to use your data in this way?

The lawful basis under which the council uses personal data for this purpose is UK GDPR Article 6(1)(e) because it is necessary for the performance of tasks and functions carried out in the public interest by the council as prescribed in the Care Act 2014, the Children and Families Act 2014 and the Childcare Acts 2006 and 2016.

Our lawful basis for processing data about criminal convictions, criminal offences or related security measures is UK GDPR Article 10, DPA 2018 Schedule 1, Part 2, Paragraph 11 - Protecting the public, because processing of criminal offence data relating to DBS status is necessary for the purpose of protecting members of the public against dishonesty, malpractice, or other improper conduct by PA’s who provide services in vulnerable people’s homes, and assisting people to make safe, informed choices.

Who may we share your data with or receive it from?

Nottingham City Council
users of the directory
organisations, groups and providers who have directory listings
regulatory bodies including Ofsted and CQC
other publicly available sources where information is intended for public use
internal teams within the councils who support service commissioning or community development
partner organisations that help maintain the accuracy of listings
IT system providers who host and support the directory platform.

The platform is provided by Zengenti, who act as a data processor for the councils.

We receive information about childcare providers directly from Ofsted so that we can meet our legal duties to give families accurate and up-to-date information. Because the Your Notts Directory is a shared system run jointly by Nottinghamshire County Council and Nottingham City Council, both councils work together to manage how this information is stored and used on the directory.

Each council normally only sees and manages the Ofsted information for providers in its own area. In rare cases, and only when needed to keep the service running smoothly, a small number of authorised staff may be able to access the other council’s information. Strict access controls are in place to make sure this only happens when necessary and is properly monitored.

May personal data be transferred overseas?

The council may for operational purposes transfer personal data overseas. In these cases, we will ensure that your personal data is protected and there are safeguards for the protection of your rights. For further details, please refer to the council’s privacy statement.

How long is your data kept for?

Your Notts Directory is a live online directory, and data is continually changed and updated. Information is retained for as long as a service or organisation remains active within the directory. Regular reviews are undertaken to ensure entries remain accurate and up to date.

If an organisation requests removal, entries will normally be deleted within 90 days, unless we have a legal requirement to retain information for longer.

Certain statutory or high-risk listings require additional retention safeguards. This is applicable to childcare, registered CQC providers, and Personal Assistants, where information will be retained for up to three years before deletion.

User accounts that remain inactive for 12 months are deleted, and archived records are reviewed regularly and removed when no longer required.

This information is held in accordance with the council’s retention schedule.

What will happen if you do not provide or we cannot obtain the data needed?

We could not operate the Your Notts Directory to help residents, professionals, and partner organisations find accurate, up-to-date information about local advice and support.

Does the service make decisions using fully automated processes?

No.

What rights do you have over this use of your data?

to be informed about how we use your data
to access a copy of your data that we process
to have us rectify or correct your data that we process
to restrict our processing of your personal data
to object to the use of your data
to have your personal data erased
to request that we transfer your information to you or another organisation
to object to fully automated decision making
to withdraw your consent (if it is the legal reason why we use your data).

Some of these rights are subject to exceptions.

For further details and how to exercise your rights, please refer to the council’s privacy statement.

Links to other websites

This privacy notice does not cover the links within the Your Notts Directory site which link to other websites. We encourage you to read the privacy statements on other websites you visit.

Making a complaint

If you have any concerns about how the council is using your personal information, you have the right to raise a complaint with our Data Protection Officer. You can contact the county council’s Data Protection Officer (DPO) by email DPO@nottscc.gov.uk or post:

Data Protection Officer
Nottinghamshire County Council
County Hall
West Bridgford
Nottingham
NG2 7QP

For further information, please see the council’s privacy statement.

If you remain dissatisfied after our response, you can seek advice and have the right to make a complaint to the Information Commissioner’s Office (ICO). The ICO is an independent body set up to uphold information rights in the UK.

Website: www.ico.org.uk
Address: Wycliffe House, Water Lane, Wilmslow, SK9 5AF
Helpline: 0303 123 1113