Privacy Policy

Last updated: 29th July 2024

1.  INTRODUCTION

Douglas City Council is committed to protecting your privacy and security and to complying with the relevant data protection laws. Please take your time to read this Privacy Policy carefully, as this policy explains how and why we collect, use, and store your personal information, to ensure that you remain informed and in control of your information. If you require this information in another language or braille, please contact Dataprotection@douglas.gov.im

This Privacy Policy is divided into the following sections:

1. Introduction
2. Who we are
3. What personal information we collect
4. When we obtain your personal information
5. How we use your personal information
6. Disclosing and sharing your personal information
7. Sending your personal information overseas
8. How we protect your personal information
9. How long do we store your personal information
10. Payment security
11. CCTV
12. Cookies and links to other sites
13. Your duty to inform us of changes
14. What we may need from you
15. Your rights and keeping you in control
16. Contacting our Data Protection Officer
17. Updates to this Privacy Policy

Appendix A – How we process your personal information

Questions?

Any questions you have in relation to this policy or how we use your personal information should be sent to Dataprotection@Douglas.gov.im or addressed to the Data Protection Officer (who has been appointed to oversee our handling of personal information) at “The Data Protection Officer, Douglas City Council, Douglas City Hall, PO Box 2, Ridgeway Street, Douglas, IM99 1AD”.

Furthermore, the data protection supervisory authority in the Isle of Man is the Isle of Man Information Commissioner, who can be contacted by calling 01624 693260 or alternatively at www.inforights.im

2. WHO WE ARE

 Douglas City Council is a local authority operating in the Isle of Man. The address for Douglas City Council is Douglas City Hall, PO Box 2, Ridgeway Street, Douglas, IM99 1AD. For the data protection law, Douglas City Council will be the Controller. Duties of a controller, can be found here: https://www.inforights.im/organisations/data-protection-law-2018/controllers-and-processors/

3.  WHAT PERSONAL INFORMATION WE COLLECT

The personal information we collect will depend upon our relationship with you and the services which we provide. Your personal information (i.e., any information which identifies you, or which can be identified as relating to you personally) will be collected and used by the Council. This includes information you give when using particular services.

We collect personal information necessary for us to perform a contract or otherwise perform services to you. We also collect personal information from third parties to allow us to do this. In addition, we may require information from you and from third parties about you to allow us to comply with legislation and regulations that apply to us – examples of this may be for anti-money laundering purposes.

Your activities and involvement with Douglas City Council will generate further information. Examples of this could be information in relation to your contact with us or ongoing account payment data; or it could be just a record of your general enquiries. It very much depends on the service that you are using.

We may generate personal information about you in relation to the services that we offer. In our housing department we would generate a customer contact record that would be kept up to date to enable us to best service your needs and requirements e.g., this may be the time of the week when you are more likely to prefer a housing repair visit.

We do collect data from third parties, but this is in a limited capacity. For example, we may collect information from social media where you have given us permission to do so, or if you post on one of our social media pages. Further, we may receive information from Government bodies in relation to you as an individual. This will only be done where there is a defined data sharing agreement between both parties, and you have been made aware.

Personal information

We may receive, generate, and/or collect from third parties the following personal information:

• Personal details, g., name, previous names, gender, date and place of birth, employment history;
• Contact details, g., address, email address, landline, and mobile numbers;
• Identification information such as national insurance number, passport number or driving license number;
• Next of kin and emergency contact details;
• Information concerning your identity, e.g., photo ID, passport information, National Insurance number or equivalent tax identification number, National ID card, birth number (or equivalent) and nationality;
• Job information, g., job title or other information about your employment;
• Financial information such as financial history and needs, income, bank details, payment details and information obtained as a result of our credit checks;
• Information on relevant family members;
• Information relating to the advice that is requested or the services that we are providing;
• Information captured during telephone calls;
• Information obtained through our Please see below for more information;
• We may carry out credit checks and these may be carried out by third parties on our behalf; (m)Complaints information;
• Records of correspondence and other communications between us, including email and social media communications;
• Information that we need to support our legal and regulatory obligations g., information relating to the detection of suspicious and criminal activity;
• License plate details in respect of car park services;
• Monitoring of telephone calls to Douglas City Council and the Housing Office; and
• Photographs of events run by Douglas City

Special category personal information

We do not normally collect or store special category personal information. However, where we do these require higher levels of protection. Types of special category personal information which may be processed about you include:

• Details of current or former physical or mental health;
• Information relating to criminal sanctions (including offences and alleged offences and any caution, court sentence or criminal conviction;
• Details of race and/or ethnicity, political opinions, religious or philosophical beliefs or trade union membership; and/or
• Data concerning sex life and/or sexual

We may process special category personal information in the following circumstances:

• In relation to an application for social housing;
• An application for employment; and
• ‘Shop watch’

We will only keep such personal information for as long as is required and in line with our Data Retention Policy.

4.  WHEN WE OBTAIN YOUR PERSONAL INFORMATION

We collect personal information from several diverse sources, including:

• Directly from you or from someone else on your behalf;
• Via publicly available sources such as internet search engines and social media sites;
• From credit reference agencies and fraud prevention databases;
• From government agencies including tax agencies and agencies that issue identification

5.  HOW WE USE YOUR PERSONAL INFORMATION

We only ever use your personal information where it is necessary:

• To perform a task carried out in the public interest or in the exercise of official authority held by the controller;
• To enter, or perform, a contract with you;
• With your explicit Usually this will be a one-off and will not permit us to continue processing indefinitely;
• To comply with a legal or regulatory obligation to use such personal information;
• To establish, exercise or defend our legal rights; and/or
• To protect your vital interests **

** Vital interests are intended to cover only interests that are essential for someone’s life. So, this lawful basis is extremely limited in its scope, and only applies to matters of life and death.

We will only use your personal information for the purposes for which we collect it, unless we consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your personal information without your knowledge or consent, where this is required or permitted by law.

You will find further details of our legal grounds for each of our processing purposes in Appendix A below.

Marketing

We do not collect your personal data for Marketing purposes. There may be situations where you have requested to be notified of a particular event or activity that you are interested in. At this time, we would ask you to opt in to receive this information and will be extremely specific about what and how your information will be used. At any time, you can choose to change your preferences.

6.  DISCLOSING AND SHARING YOUR PERSONAL INFORMATION 

We will never sell your personal information.

We may share personal information in assisting with responding to enquiries and complaints and with subcontractors or suppliers who provide us with services. However, we only use these details to provide the service the person has requested and for other closely related purposes. For example, if you have a problem with your social housing heating system then we will pass your information to the private central heating contractor. However, these activities will be carried out under a contract which imposes strict requirements on our supplier to keep your information confidential and secure. Our contractor will not use your information for any other purpose.

Further reasons for sharing your personal information may include

• Prevention and detection of fraud, and where litigation is being contemplated or defended;
• Prevention and detection of crime;
• Employment Screening;
• To fulfil a service offering, g., Boiler servicing
• Credit and financial checks;
• Audit requirements; and
• To fulfil our legislative

Information may be shared with the following organisations:-

• Law enforcement agencies;
• Government departments;
• Local Authorities;
• Occupational Health;
• Contracted third party service providers;
• Financial companies;
• Financial organisations’ including Banks and Pensions providers;
• External and Internal Auditors; and
• Third sector organisations’ (Charities).

Finally, we may also share information with the Isle of Man Public Records Office, which may be permanently preserved for research use at the Isle of Man Public Record Office if the records containing your personal data are selected for permanent preservation under the Public Records Act 1999. This is because the Isle of Man Public Record Office preserves records of the Isle of Man public authorities that are of long-term historic and cultural value. Should you wish to find out more information regarding this please contact the Isle of Man Public Record Office (which is part of the Department of Enterprise) at public.records@gov.im and/or the Department of Enterprises Data Protection Officer at DPODfE@gov.im

7.  SENDING YOUR PERSONAL INFORMATION OVERSEAS 

We (or third parties acting on our behalf) will store or process information that we collect about you in countries outside the Isle of Man, UK and the European Union. Where we make a transfer of your personal information outside of the Isle of Man and EU, we will take the required steps to ensure that your personal information is protected. Such steps may include placing the party we are transferring information to under contractual obligations to protect it to adequate standards. If you would like further information regarding the steps we take to safeguard your personal information, please contact our Data Protection Officer using the details outlined above in paragraph 1.

8.  HOW WE PROTECT YOUR PERSONAL INFORMATION 

We employ a variety of physical and technical measures to keep your personal information safe and to prevent unauthorised access to or use or disclosure of your personal information.

We store your digital data in safe and secure locations within the Council’s ICT infrastructure in the Isle of Man. We control who has access to information (using both physical and electronic means). This data is also backed up to protect against loss of our data storage facility.

Some of our services use the internet to pass data and therefore this data is stored in the ‘cloud’. The services the Council use has undergone strict evaluation, ensuring they run to the highest security standards. We only use cloud services that operate in the UK and EU and are therefore governed by the same strict data protection laws as the Isle of Man.

Our physical files are stored in secure locations and only permitted staff gain access to these files. These premises are protected using access security systems.

Our Document Retention policy identifies security levels required for certain files. Files and documents that contain personal information are given our highest level of security requirement.

Our staff receive data protection training, and we have a set of detailed data protection procedures which personnel must follow when handling personal data.

9.  HOW LONG DO WE STORE YOUR PERSONAL INFORMATION

We will only store your personal information for as long as reasonably necessary to fulfil the purposes set out in this Privacy Policy and to comply with our legal obligations. The record types that we manage are defined within our Council Retention Policy.

How long information will be stored for is contained within the Council Retention Policy and depends on the information in question and what it is being used for. We must keep personal data for specific periods in line with legislation. For example, if you have applied for a job with the Council but you were unsuccessful, we will delete your information straight away, as this personal information is no longer required by the Council.

We continually review what information we hold and delete what is no longer required. We never store payment card information.

10.  PAYMENT SECURITY

The Council accepts several payment options, and we must collect and process payments for several of our services, e.g., Car park payment machines, payment counters, on-line payments, etc.

If you are using a payment card (credit/debit) we will never store your card payment details. Online

All electronic payment forms (accessed via our website) that request financial data will use the Secure Sockets Layer (SSL) protocol to encrypt the data between your browser and our servers.

If you use a credit/debit card to make a payment, your card details are sent securely to our payment providers (World pay, Barclaycard and Access Paysuite), we will never store your card payment details on our systems. Our payment providers are all PCI DSS Compliant **.

If you are making your transaction from your PC or Mobile device, we cannot guarantee the security of your home computer or the internet, and any online communications (e.g., information provided by email or our website) are at the user’s own risk.

** The Payment Card Industry Data Security Standard (PCI DSS) is an information security standard for organizations that handle branded credit cards from the major card schemes. The PCI Standard is mandated by the card brands and administered by the Payment Card Industry Security Standards Council.

Phone

Any payments made over the telephone using payment card will be done confidentially. No details are written down, they are always input into our payment machines in real time.

In person

If you choose to pay by payment card, then this will be done securely using one of our card payment machines. The card and pin will only be managed by yourself, we will never ask for your card or pin at time of payment.

All cheques will be kept safe and secure in our safe area until they are passed to the banks.

11.  CCTV 

Some of our premises have CCTV and you may be recorded when you visit them. CCTV is there to help provide security and to protect both you and Douglas City Council staff. CCTV will only be viewed, when necessary (e.g., to detect or prevent crime), and footage is only stored temporarily in line with our retention policy. The only exception to this would be if footage has been highlighted for review.

Clear CCTV signage is in place in areas where we operate CCTV.

Public CCTV is also operated by the Council and a full CCTV operating protocol can be found on the Council’s Website at www.douglas.gov.im

12.  COOKIES AND LINKS TO OTHER SITES

Cookies 

Our website uses cookies. Cookies are files containing insignificant amounts of information which are downloaded to the device you use when you visit a website. Cookies are then sent back to the original website on each subsequent visit, or to another website that recognises that cookie. Cookies do lots of different and useful jobs, such as remembering your preferences, and improving your online experience.

You may refuse the use of cookies by selecting the appropriate settings in your browser, however, if cookies are disabled you may not be able to fully utilise our website.

Links to other sites 

Our website contains hyperlinks to many other websites. We are not responsible for the content or functionality of any of those external websites (but please let us know if a link is not working by using the ‘Contact us’ link at the top of the page).

13.  YOUR DUTY TO INFORM US OF CHANGES

It is important that the personal information we hold about you is accurate and up to date. Please keep us informed if your personal information changes during your relationship with us.

14.  WHAT WE WILL NEED FROM YOU

We will need to request specific information from you to help us confirm your identity and ensure your right to access personal information (or to exercise any of your other rights). This is to ensure that personal information is not disclosed to any person who has no right to receive it.

15.  YOUR RIGHTS AND KEEPING YOU IN CONTROL

Under data protection law, you have the right to make requests about the personal information we hold about you. We will not usually charge for dealing with these requests. If you wish to exercise these rights at any time, please contact our Data Protection Officer using the details set out above in paragraph 1.

There will be cases where we will not be able to comply with your request (such as where this would conflict with our obligation to comply with legal requirements). However, if we cannot comply with your request, we will tell you the reason provided we are allowed by law, and we will always respond to any request you make.

There may be circumstances where exercising some of these rights (such as the right to erasure, the right to restriction of processing and the right to withdraw consent) will mean that we can no longer provide you with services and may therefore result in the cancellation of the relating contract/your services.

Your rights include:

The right to access personal information/ Subject Access Requests (SAR’s)

The right to confirmation as to whether we have your personal information and, if we do, to obtain a copy of the personal information we hold (this is known as subject access request) and certain details as to how we use it. We shall reply promptly, and certainly within one month from the point of receiving the request and all necessary information from you. We will usually provide you with your information in writing, unless you request otherwise, or where you have made the request using electronic means, in which case the information will, where possible, be provided to you by electronic means. Further information can be found here: https://www.inforights.im/organisations/data-protection-law-2018/rights/access-to-personal-data/

The right to erasure

You have the right to ask us to erase your personal information in certain circumstances, for example, where the personal information we collected is no longer necessary for the original purpose. This will need to be balanced against other factors however. For example, we may have legal obligations which mean we cannot comply with your request. Further information can be found here: https://www.inforights.im/organisations/data-protection-law-2018/rights/erasure/

The right to rectification

We take reasonable steps to ensure that information we hold about you is accurate and complete. However, you have the right to have personal information amended or updated without any undue delay if you do not believe this is the case. Further information can be found here: https://www.inforights.im/organisations/data-protection-law-2018/rights/rectification/

The right to restriction of processing

In certain circumstances, you have the right to request that we stop processing of your personal information, for example, where you think that we no longer need to use your personal information or where you think that the personal information, we hold about you may be inaccurate. Further information can be found here: https://www.inforights.im/organisations/data-protection-law-2018/rights/restricting-processing/

The right to data portability

You have the right to receive your personal data, which you have provided to us, in a structured, commonly used digital (machine readable) format and have the right to transfer this data to another controller, without objection or obstruction from us. It should be noted that this request can only be met where data is being processed by automated means and is therefore stored in a way that it can be extracted into a machine-readable file. For example, any data stored on paper records would not be available by this method (however, see above for how to obtain copies of your personal information).

Please keep in mind that there are exceptions to the rights above and, although we will always try to respond to your satisfaction, there may be situations where we are unable to do so. Further information can be found here: https://www.inforights.im/organisations/data-protection-law-2018/rights/data-portability/

The right to Object

You have the right to object to the processing of your personal information relating to a particular situation at any time. This includes personal profiling. We shall no longer carry out the processing of this personal information unless we can demonstrate legitimate grounds for the processing. Further information can be found here: https://www.inforights.im/organisations/data-protection-law-2018/rights/objections-to-processing/

The right not to be subject to automated decision making

We do not carry out automated decision making based upon your personal information. Information will be used to assess certain circumstances, but this is always subject to ratification; e.g., we have a housing points system for social housing applications, however final allocations of properties are always managed by our allocations team. Further information can be found here: https://www.inforights.im/organisations/data-protection-law-2018/rights/automated-individual-decision-making-including-profiling/

The right to complain to the Information Commissioner

You can complain to Douglas City Council directly by contacting our Data Protection Officer using the details set out above in paragraph 1.

If you wish to make a complaint which does not relate to your data protection and privacy rights, you can do so in accordance with the Council’s Complaints Policy that can be found on our website.

If you are not happy with our response, or you believe that your data protection or privacy rights have been infringed, you can complain to the Isle of Man Information Commissioner that regulates and enforces data protection law in the Isle of Man. Details of how to do this can be found at www.inforights.im

16.  CONTACTING OUR DATA PROTECTION OFFICER

You may contact our Data Protection Officer if you have any questions about how we collect, store, or use your personal information.

If you would like further information on your rights or wish to exercise them, please write to our Data Protection Officer Douglas City Council, PO Box 2, Ridgeway Street, Douglas, IM991AD or email Dataprotection@Douglas.gov.im

17.  UPDATES TO THIS PRIVACY POLICY

We will amend this Privacy Policy from time to time to ensure it remains up-to-date and accurately reflects how and why we use your personal information. The current version of our Privacy Policy will always be posted on our website.

APPENDIX A – HOW WE PROCESS YOUR INFORMATION 

We`ll use your information for purposes including:

1. To deliver our products and services to you on an ongoing basis and to administer the contract we have with you: We`ll use your information to provide products and/or services to you and to administer your accounts. This extends to the provision of:
   • Social Housing services;
   • Private parking;
   • Library services;
   • Golf course membership;
   • Receiving and processing payments including Rates, rent, memberships, and private refuse collection;
   • Refuse and recycle collection;
   • Crematorium and burial services;
   • Building Control;
   • Byelaws Enforcement;
   • Dilapidated properties;
   • Procurement of goods;
   • Venue hire; (m)Allotments;

• Electoral matters;
• Commercial property management
• City Centre Management activities (i.e. Shop watch); and
• IOM Local Government Superannuation

Our lawful basis for using your personal information for this purpose is to perform our contract with you, that it is necessary for compliance with a legal obligation, that it is necessary for the performance of a task carried out in the public interest, and/or necessary in the exercise of official authority vested in Douglas City Council.

2. Product and service improvement: We`ll analyse your information to identify service and product improvements. The lawful basis for this is to perform our contract with you and/or that it is necessary for compliance with a legal obligation and/or that it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in Douglas City
3. Photographs, pictures, press releases: We run several local events throughout the year, ranging from large events such as Douglas Fireworks Display, to small events, such as young reading groups in our library. With your consent (or the consent of a parent if aged under 16) and in the interests of generating a closer community we will routinely publish photographs, pictures and press releases which may include your personal information. Furthermore, we may forward photographs of events to media outlets such as local Our basis for lawful processing of this personal information is that it is undertaken with consent, and/or that it is necessary for the performance of a task carried out in the public interest.
4. CCTV: We have several CCTV cameras in operation. CCTV is there to help provide security and to protect both you and Douglas City Council CCTV will only be viewed, when necessary (e.g. to detect or prevent crime), and footage is only stored temporarily in line with our retention policy. The only two exceptions to this would be if footage has been highlighted for review and Live Streaming of Chapel Services, with approval of relatives. The lawful basis for processing of this personal data is that it is processed to protect the vital interests of data subjects and/or is undertaken in the interests of the public.
5. Telephone calls: We will monitor, or record phone calls made to the reception and housing office of Douglas City Council in case we need to check that we have carried out your instructions correctly, to resolve queries or issues, for legal purposes, to protect our legal rights in case of a dispute, and to help detect and prevent fraud or other crimes. Our basis for lawful processing of this personal information is that it is necessary to perform our contract with you, to comply with a legal obligation and/or that it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in Douglas City Council.
6. To prevent and detect crime including e.g. fraud, terrorist financing and money laundering: This will include monitoring, mitigation, and risk management. We do this to comply with our legal obligations. We will share your information with relevant agencies, law enforcement and other third parties where the law allows us to for the purpose of preventing or detecting Additionally, we will take steps to help prevent financial crime and manage risk. We`ll do this because we have a legal obligation to prevent or detect crime or it is in the public interest. We will be required to use your information to do this, even if you have asked us to stop using your information. That could include (amongst other things) passing information to relevant agencies if we think you have given us false or inaccurate information, or we suspect criminal activity.
7. IT systems: We`ll use your information to allow us to provide you with access to Douglas City Council online The platform will allow you to communicate with us directly or indirectly for applying for services online. The lawful basis for using your information for this purpose is to perform our contract with you.
8. To record events of local and national importance: On occasions where there is an event of local or national importance your personal data may be forwarded to the Isle of Man Public Record Office. Our basis for lawful processing of this personal information is that it is undertaken with consent, that it is necessary for compliance with a legal obligation and/or that it is necessary for the performance of a task carried out in the public interest, and/or necessary in the exercise of official authority vested in Douglas City Council.
9. Protecting our legal rights: We will need to use your information to protect our legal rights e.g. in the case of defending or the protection of legal rights and interests, court action and/or managing complaints or disputes. This will be in connection with action taken against you or other persons. We would do this on the basis that it is necessary for the performance of a task carried out in the public interest, necessary for the performance of a contract and/or is necessary for compliance with a legal obligation to which Douglas City Council is subject.