Direct Payment Support Services privacy notice

Norfolk County Council ("us", "we", or "our") operates this mobile application which enables you to complete work timesheets on the app and for the completed timesheet to be sent to your employer's payroll provider (hereinafter referred to as the "Service"). 

We are a data controller which means that we are responsible for deciding how we hold and use personal information about you. We are required under data protection legislation to notify you of the information contained in this privacy notice.

This privacy notice informs you how we collect, use, and disclose your personal data when you use our Service and the choices you have associated with that data.  We also provide further details regarding:

• Who we are including the name and address of our Data Protection Officer
• How long we use your information for
• Your rights under the General Data Protection Regulation (GDPR) (although subject to exemptions under the GDPR) and how to exercise them.

You can see this information in our General Privacy Notice on our website.

Please note we only act as the data controller for the information collected via this app for the purpose of providing the service. We do not act as a data controller for the payroll service itself. For that payroll service, your employer will be the data controller and we will be the data processor.  As such, your employer will issue you with their own privacy notice and you should contact your employer for any further information.

We use your data to provide and improve the service. By using the service, you agree to the collection and use of information in accordance with this notice. Unless otherwise defined in this notice, the terms used in this notice have the same meanings as in our  General Privacy Notice.

Information collection and use

We collect several different types of information for various purposes to provide and improve our service to you.

Types of data collected - personal data

While using our service, we may ask you to provide us with certain personally identifiable information that can be used to contact or identify you ("personal data"). Personal data may include, but is not limited to:

• Email address
• First name and last name
• Tracking and cookies data and
• Usage data

Usage data

When you access the service with a mobile device, we may collect certain information automatically, including, but not limited to, the type of mobile device you use, your mobile device unique ID, the IP address of your mobile device, your mobile operating system, the type of mobile internet browser you use, unique device identifiers and other diagnostic data ("usage data").

Tracking and cookies data

We do not use cookies or similar tracking technologies to track the activity on our service.

Use of data

We use the collected personal data for various purposes:

• To provide the service
• In connection with the prevention, detection and investigation of fraud
• To provide customer care and support
• To provide analysis or valuable information so that we can improve the service
• To monitor the usage of the service
• To detect, prevent and address technical issues

Transfer of personal data

Your information, including personal data, will not be transferred outside the UK or with any third party companies.

Your submission of such information represents your agreement to the processing of data to support the delivery of our service.

We will take all steps reasonably necessary to ensure that your personal data is treated securely and in accordance with this privacy notice and no transfer of your personal data will take place to an organisation or a country unless there are adequate controls in place including the security of your personal data.

Disclosure of personal data

Legal requirements

We may disclose your Personal Data:

• To comply with a legal obligation
• To comply with the legitimate interests pursued by us
• To a service provider (as described below)
• To comply with financial reporting and scrutiny

Security of personal data

The security of your personal data is important to us, but remember that no method of transmission over the internet, or method of electronic storage is 100% secure.  While we strive to use commercially acceptable means to protect your personal data, we cannot guarantee its absolute security.

Service providers

We may employ third party companies and individuals to facilitate our service ("service providers"), to provide the service on our behalf, to perform service-related services or to assist us in analysing how our service is used.

These third parties have access to your personal data only to perform these tasks on our behalf.  They are bound by GDPR legislations and are obligated not to disclose or use it for any other purpose.

We do not knowingly collect personal data from anyone under the age of 16. If you are a parent or guardian and you are aware that your child/children have provided us with personal data, please contact us. If we become aware that we have collected personal data from children without verification of parental consent, we take steps to remove that information from our servers.

Changes to this privacy notice

We may update our privacy notice from time to time. We will notify you of any changes by posting the new privacy notice on this page.

We will let you know via email and/or a prominent notice on our service/app prior to the change becoming effective and update the "effective date" at the top of this privacy notice.

You are advised to review this privacy notice periodically for any changes. Changes to this privacy notice are effective when they are posted on this page.

Contact us

If you have any questions about this privacy notice, email us dpss.app@norfolk.gov.uk.

Date of notice

This notice was updated in August 2019.