Engagement platform privacy notice

Find out how Stirling Council uses personal data by checking the Council’s website at the following address:

https://www.stirling.gov.uk/privacy-statement/

Our website contains a Register of Data Processing which lists all the different ways
in which the Council uses personal data.

This Privacy Notice provides more information about just one of those processes.

The Council has a Data Protection Officer to make sure it is complying with data protection laws.

They can be contacted at:

Data Protection Officer
Stirling Council
Old Viewforth
14-20 Pitt Terrace
Stirling
FK8 2ET

Email: dataprotection@stirling.gov.uk
Telephone: 01786 404040

Stirling Council’s engagement platform aims to strengthen existing approaches to allow us to deliver responsive, inclusive, participatory decision making at all levels.  The digital approach will support the Council in enhancing our participation/engagement strategy and will digitise the way we engage with individuals, communities and businesses.  This platform also includes e-petitions and the ability to apply a digital signature in support.  

We might use your personal data for the following purposes:

First and foremost, to communicate your input to the Council with relevant context, and to draw aggregated reports of all the data collected on this platform to assist their decision-making.

• To create and maintain your user profile on this website
• To manage the identification and authentication of users.
• To provide information about your community and/or alert you when activities on the platform may interest you. You can stop user emails from your user profile at any time.

To improve our services and monitor their functionalities.

Personal Data that you provide during the registration process on the Platform, some of which are optional.

The personal data that we might collect from you are:

• First and last name
• E-mail address
• Postcode
• Year of birth
• Area of residence
• Preferred language
• If you choose to sign-in via a 3rd party authentication provider as Google Accounts or Facebook, we will get this data from them. If you choose to verify your identity with a 3rd party identity provider we will get this information from them.

Every action you take on the platform (voting, posting an idea, writing a comment, answering a poll) is registered and stored. This data is also linked to your registration data which will enable the Council to link your platform profile to this participation data.

GDPR Article 6 (1)(a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes

We (and third party processors acting on our behalf) collect information about usage of our platform for assessing the good functioning and security of the platform. To this end, we collect technical information that can identify you, such as your IP address and browser details. By using our services you agree to this data being collected.

We also gather usage data to improve our services, you can opt-out of this collection at all time from the consent manager.

This data is provided by the user when the sign up and interact with the platform.   

Data is stored encrypted at rest within EU storage centres.  Limited personal data may be shared with subprocessors outside the EU under the appropriate

Standard Contractual Clause agreements established by the processor that supplies the platform.

We will only retain your personal information for as long as necessary to fulfil the purposes of your enquiry or request.  This includes for the purposes of satisfying any legal, accounting, or reporting requirements.

In order to participate on the platform, you will be required to sign up for an account.  You are free to decide whether or not to provide optional data as outlined in the sign up process. In addition, you always have the right to request Citizenlab (the supplier) and the Council to correct, supplement or remove your personal data. You acknowledge that a refusal to provide or a request for the erasure of personal data means that certain services can no longer be delivered. You may also request that the processing of your personal data is limited. If you choose to remove your account from the platform, the personal data that was collected about you will be removed from our servers. Some personal information about you might remain in the logging data we keep for security and legal reasons for up to 30 days.

Any accounts that lay dormant will be erased after a year where no activity is recorded.  

Citizenlab (the supplier) will share your personal data with the Council on behalf of which we gather this data. We share your data to the sub-processors working on our behalf. We will never sell or rent your personal data to other service providers, nor will we share your Personal Data with any service providers who are not compliant with the all data protection laws.

For the purposes of internal analysis, all personal data will be anonymised.  

For the purposes of e-petitions, information will be shared internally for the purposes of the petitions process and to ensure appropriate checks are undertaken by relevant colleagues.  This information will not be shared out with this process. 

You have the following rights under data protection laws. If you have a request under any of these rights, you can make a subject access request.

• The right of access – You have the right to request information we hold about you. This is known as a subject access request and is free of charge. We must respond within one month, although this can be extended to three months if the information is complex.
  
  
• The right to rectification - You are entitled to have your information rectified if it is factually inaccurate or incomplete. We must respond to your request within one month. If we decide to take no action, we will tell you why and let you know about your right of complaint to the UK Information Commissioner
  
  
• The right to erasure - You have the right to ask us to delete your information or stop using it. It will not always be possible for us to comply with your request, for example, if we have a legal obligation to keep the information. If we decide to take no action, we will tell you why and let you know about your right of complaint to the UK Information Commissioner.
  
  
• The right to restrict processing - You have the right to restrict how your data is processed in certain circumstances, for example, if the information is not accurate. If a restriction is applied, we can retain just enough information to ensure that the restriction is respected in future. We must tell you if we decide to lift a restriction on processing.
  
  
• The right to data portability – You have the right to object to processing, if we are processing your personal data with your consent, and it is held in a structured, commonly used, machine-readable form, you have a right to ask us to transmit it to another data controller so they can use it. This right does not apply if we process your personal data as part of our public task.
  
  
• The right to object - You can object to your information being used for profiling, direct marketing or research purposes.
  
  
• You have rights in relation to automated decision making and profiling - to reduce the risk that a potentially damaging decision is taken without human intervention.

If you want to complain about or comment on how we have processed your personal information, you should email dataprotection@stirling.gov.uk

If you are still unhappy with how the council handled your complaint, you can contact the UK Information Commissioner's Office at:

The Information Commissioner,
Wycliffe House,
Water Lane,
Wilmslow,
Cheshire SK9 5AF

Phone: 0303 123 1113

You can find further information on the Information Commissioners Office website.