How we use your information
Bootstrap Enterprises is committed to protecting your privacy. This document describes how we process your personal information in accordance with the General Data Protection Regulation (GDPR) and Data Protection Act 2018. It also contains important information about your rights and how to contact us.
Who are we?
Where the term ‘we’ is referred to throughout this notice, ‘we’ means Bootstrap Enterprises, and other required contracted delivery partners unless otherwise specified.
Bootstrap Enterprises services are commissioned by various contactors and the Department for Work and Pensions (DWP) which are part funded by the European Social Fund. We have legal agreements in place to collect and use information obtained from customers, contractors and DWP in order to deliver our services.
Our work supports participants to make a positive change in their life and take steps towards finding employment that lasts, tackling the range of barriers that may stand in their way. Bootstrap Enterprises support participants regardless if they are in employment or not. During this time you can expect to receive a tailored service, which utilises 1:1 sessions, workshops, Health and Wellbeing and other required and agreed support.
- Our contractors (including DWP) are the Data Controller in relation to the processing of your personal data.
- Bootstrap Enterprises and our contractors are Data Processors in relation to the processing of your personal data.
How do we use your information?
All organisations must have a valid, lawful reason to process your information. We will only collect and use your information for the lawful purposes of administering the services that we are contracted to deliver on behalf of our contractors and DWP.
The information we collect includes your name, address, National Insurance Number and any other information relevant to the aims of the programme that you are participating in, to provide you with a service. We ask you for information about you so that we can support you, and to identify services which we feel could benefit you on the programme.
Your information may also be used for:
- Performance monitoring and analysis to help us assess the quality and standard of our services
- Conducting investigations in response to a complaint or enquiry
- Accounting and record keeping e.g. keeping accounts related to business activities and financial management
- Research and evaluation such as participating in feedback surveys
Research and evaluation
In order to ensure that we provide you with the best possible service, we may from time to time conduct research and evaluation. Sometimes we will do this by aggregating and anonymising the data, which means that no one can identify you. On occasion we may ask you to take part in a new piece of research and provide additional information, or share your information with a third party for the purpose of research, this will only ever be done with you knowledge and consent.
Sharing your Personal Information
When required to do so, Bootstrap Enterprises may share your information with DWP, JCP, your Local Authority, as per contractual obligations and in accordance with the GDPR.
- Where applicable, Bootstrap Enterprises may contact your employer to verify your employment information and share employment details with DWP.
- Our Prime Contractors have full access to participant records, for the purpose of administering the contracts, sharing key, contractually required information with the DWP and for providing the IT systems which house participant records.
- With participant consent, we may share information with other services which we identify as being beneficial to them.
- When necessary, for example, in the unlikely event for emergencies or safeguarding concerns, it may be in the vital interest of participants to share information with their GP, other Health Professionals or refer to external services that will provide help.
We will not share personal information with others unless required to do so by law and unless we obtain individual consent.
We do not transfer personal information outside the EEA.
How long will we keep your personal information?
We have defined retention periods for the information we hold and we will not keep personal information any longer than we are legally and contractually required to do so. Once we are no longer required to keep your information, it will be securely destroyed, in accordance with destruction guidelines.
How the law protects you
The law protecting your personal information is the General Data Protection Regulation (GDPR) and Data Protection Act 2018. As custodians of personal information, we are committed to ensuring that such personal data is processed lawfully and respectfully, and by ensuring that we are compliant with the Regulations.
In accordance with the GDPR, we must have a valid lawful reason to process individual information.
Where we need individual agreement to process personal information, for example, by passing contact details to someone offering a specific service, we will ask for consent, and will clearly state why the information is needed and who we will share it with. If agreement is confirmed for information to be shared, we will record your consent on participant records. We will regularly such review consents to make sure that the relationships, and purposes for processing, have not changed.
Right to Withdraw Consent
Where participants have consented for us to share information with a specific organisation or individual, they will have the right to withdraw their consent at any time. Should they wish to withdraw their consent, they should advise their key worker, or, send a written request to the Data Protection Officer (address below), who will process the request.
Keeping your information safe
We are committed to taking all reasonable measures to ensure we maintain the confidentiality and security of personal data for which we are responsible, whether electronically or on paper.
Our staff are required to undertake data protection training, and are subject to the Common Law Duty of Confidence which requires us to protect personal information, inform individuals of how their information will be used, and to allow them in most cases to decide if and how their information can be shared.
Individual rights in connection with Personal Information
Participants have a number of rights with regard to their personal data, including the right to:
- be informed of why and how we process their data
- request a copy of the information we hold on them
- have any incorrect information updated and put right
- deletion of information, once we have no legal right to hold it
- restrict processing in certain circumstances
- object to unwarranted processing
If individuals have any questions in relation to their rights, or if they would like to receive a copy of their records, correct or request erasure of personal information, or object to the processing of personal data, please contact the Data Protection Officer.
To make a request:
- Tell your Advisor who will start the process for you
- Send your request in writing to: The Data Protection Officer, Bootstrap Enterprises, 35 Railway Road, Blackburn, BB1 1EZ
- Email firstname.lastname@example.org
Please note: Requests will need to include sufficient information to enable us to correctly identify your records (e.g. full name, address, date of birth, and NI number if known).
Complaints and Disputes
If a query or complaint in relation to personal data rights is raised we will endeavour to respond as soon as possible. Requests for a copy of personal information will be responded to with a one month period.
If a participant remains dissatisfied with how we have handled your complaint or request for information, you have the right to complain to the Data Protection Officer for the Prime Contractor responsible for the relevant delivery programme. This information can be accessed via your Key Worker or the Bootstrap Enterprises Data Protection Officer at email@example.com.
If you are still not satisfied with how we are processing your information, you can write to the Information Commissioner’s Office at:
Information Commissioners Office,
Cheshire SK9 5AF
Review of this privacy notice
We review this Privacy Notice to ensure we keep you up to date about what we are doing with your personal information and any changes in processing. This privacy notice was last updated on 25th May 2018.