Ingeus UK Ltd are fully committed to ensuring that we are transparent about how we process your personal information. The ‘processing’ of your personal information includes the collection, recording, storing, changing, sharing, general use, or destruction of your information.

This Privacy Notice describes what data we collect, why we collect it, how we use it, how we keep it secure, and the conditions under which we share it. It also outlines your rights under the General Data Protection Regulation (GDPR) and the Data Protection Act 2018.

This Notice may be updated periodically, in line with changes to our processing or legislative updates. All changes will be published on our website.

What is the Working Well (Work and Health) Programme?

The Working Well (Work and Health) Programme is an employment support programme set up to help thousands of people like you improve their lives. It has been designed to help support those with physical and mental health conditions, and those encountering other barriers, to find sustained, good quality, well-paid employment.

Your Jobcentre Plus Work coach has referred you because they think it could help you overcome the obstacles you have finding work. If you join the Working Well (Work and Health) Programme you will have a keyworker and access to the Personal Support Team who will work with you for up to 21 months. Your Keyworker will work with you to help you to plan your journey back to work and support you with things like writing your CV, finding work experience and planning childcare.

This programme has been commissioned by two government bodies that are responsible for Working Well (Work and Health). These are the Greater Manchester Combined Authority (GMCA) and the Department for Work and Pensions (DWP). The programme is also part funded by the European Social Fund (ESF).

Who are we?

Ingeus UK Ltd is a company incorporated in England, registered at Companies House (04320853) who has been commissioned by GMCA to provide the Working Well (Work and Health) Programme.

Ingeus UK Ltd and our Delivery Partners (such as The Growth Company, Pluss and Pathways, and any other Delivery Partner with which Ingeus UK Ltd has a legal agreement), collect, share and use information obtained from Participants, GMCA, Department for Work and Pensions (DWP) and Jobcentre Plus (JCP) in order to provide the services described above.

By collecting information from you, Ingeus UK Ltd and our Delivery Partners can better identify your individual needs and how best to support you whilst on the programme. In Data Protection terms:

  • Ingeus UK Ltd is a Joint Data Controller for the processing of personal data in relation to the WHP GM services. We process your data alongside GMCA who are also a Data Controller.
  • Ingeus UK Ltd is the Data Controller for the processing of your health information provided directly to one of our Registered Health Professionals.

Each organisation is a Data Controller in their own right, as defined in the GDPR. This is for the information that they have directly collected themselves. This means that they have the specific responsibility for this information individually.

For a more detailed explanation about what a Data Controller is, please visit the Information Commissioner’s Office website:.

What personal information do we process?

  • Information such as your name, address, date of birth, contact details, gender, family circumstances
  • National Insurance Number
  • Health, wellbeing and lifestyle information
  • Education history, employment status, skills and qualifications
  • Data about criminal convictions or offences

How we use your information

Ingeus UK Ltd process your information in order to provide you with the best possible support whilst on programme, as well as to meet the requirements of our contracts and other legal obligations.

During the course of the programme your Keyworker will do some assessments and also keep notes about how you are doing and what you have discussed. They will share some of this information with other organisations but only the minimum amount necessary and only with those that need to know. This will allow your Key Worker and the other specialists you are involved with to work together to:

  • Avoid the doubling up of services
  • Reduce the number of times you have to tell your story
  • Make sure you don’t have any appointments that clash

The law protecting your personal information is the General Data Protection Regulation (GDPR) and Data Protection Act 2018. As custodians of your personal information, Ingeus UK Ltd are committed to ensuring that your personal data is processed lawfully and respectfully, and by ensuring that we are compliant with the law. We cannot process your information without having a valid, lawful reason for doing so. Key reasons for processing your information are described below, further details about the organisations we share with and the legal basis for processing can be found at the bottom of this page.

  • To bring you on board the programme, we will receive information including your name, address, date of birth, National Insurance Number, and additional information, which relates to any health and/or disability, and contact details, from JCP. This provides us with a way of contacting you to arrange a first appointment. 
  • When you attend your first appointment and throughout the programme, you will be asked questions that allow our staff to assess the level of support you require. Your Keyworker will make some notes about how you are doing on the programme and what has been discussed during your appointments.
  • It may be that some of this information is shared with other organisations who can provide you with additional support. Your information will only be shared with those that need to know, with the minimum amount of information being shared, and always with your verbal or written consent.
  • Your information will be shared with employers for the purpose of making applications, supporting you into secure employment and to stay in your role.
  • The provision of the programme has been part funded by the European Social Fund (ESF). One of the conditions of this backing is that the GMCA must provide some information about the people that go on the programme. To show that they are the right people for the programme and that they actually went on the programme. To make sure that the funds are being used properly, an audit is undertaken of the programme and the people receiving support. This may involve some of your information being shared with the auditor. We also have to pass on information to DWP (and the ESF) to confirm the progress you have made and your employment status.

Sharing your Personal Information

The aim of this programme is to assist you as best as possible during your progression on the programme. As such, we may work with other organisations to identify certain services that we think you could benefit from and to ensure that any support is co-ordinated to best suit your needs. In this way, you do not have to repeat yourself and provide the same information over again.

Routine Sharing

We will routinely share your personal information with the following people/organisations:

  • Your Work Coach – Your Keyworker will share information to update them on your progress, including whether you have completed the programme, achieved any key milestones or left early, or for providing you with additional support.
  • Contract Commissioner – Ingeus UK Ltd will share information with the Lead Authority (GMCA) who have commissioned the Working Well (Work and Health) Programme. The contract stipulates what information is to be shared, the way it is to be shared and the information security requirements that must be adhered to. Your Keyworker will also work with your local council in order to help you access services that they are able to provide that your Keyworker cannot.
  • European Social Fund (ESF) - One of the conditions of the ESF funding is that the GMCA must provide some information about the people that go on the programme, to demonstrate that they are the right people for the programme and that they actually attended. At the start of the programme you will be told that the programme has ESF support and will be given a leaflet explaining this. You will be asked to give some information to help fill out an ESF form and be asked to sign that you have been given the leaflet and that you understand that this information will be stored and used for ESF purposes. Both the GMCA and Ingeus UK Ltd must be checked and reviewed as part of the ESF process. The checks that will happen use random test groups. This means that your information might be used to help with these checks. These checks make sure the money ESF has given the GMCA is being spent on what it is meant to be. Things like your keyworker and the support you receive on the programme.
  • Direct Delivery Partners – Your information may be shared with organisations that deliver services on our behalf (such as The Growth Company, Pluss and Pathways).  In order to share this information, we have legal contracts in place with those organisations, which state how your personal information is to be securely processed.
  • Ad- hoc support providers - With your consent, we may provide your personal information to other support providers who offer specific services that we think you could benefit from. We have Data Sharing Agreements in place with these organisations and provide only the information necessary to support you. This information will only be provided with your consent.
  • Employers - You may be offered the chance to take part in some employment. Your Keyworker will share information to allow the employer to know who you are and the skills and experience that you can bring to the job, whilst also notifying them if any adaptations are needed in the work-place or to your work hours.
  • Training providers - You may also be offered the chance to take part in some training courses in order to help you improve your skills. Your Keyworker will share information to let the course provider know who you are and what skills you already have in order to assist in finding the correct level of course for you.

Health support sharing

Your Keyworker may feel that it would be beneficial for you to work with the Health Team, who are made up of qualified Health Professionals, such as physiotherapists and psychologists. They will where necessary share information with your GP, other Health Professionals or refer you to external services that they think will help you.

This service is meant to help improve your health and wellbeing by:

  • providing understanding and education around health conditions and symptoms
  • empowering you to better manage your health by yourself
  • preparing you for returning to the right type of employment
  • help you to see that the right type of work can help your health and wellbeing 

As part of being able to use this service your Keyworker will share your information with the Health Team. This sharing will be for:

  • arranging your appointment
  • the reason for your referral
  • to enable them to provide you with the right support, advice and guidance

This will save you having to repeat yourself and give your Health Professional a chance to prepare for the appointment. As well as a focal point of where to start with your support. The information you provide to the Health Professional will be kept in a separate confidential record. However, the Health Professional will share some very basic information with your Keyworker. This would include:

  • attendance at the appointment
  • employment related guidance such as suitable job goals that would help your health condition
  • a list of other services they think you might benefit from
  • any further help they will be providing to you on a 1:1 or group basis

By doing this your Keyworker will understand the types of work, adaptations and training that are right for you.

The Health Professional that you meet with will talk to you more about the sharing process. They will also ask you to sign a consent form. This is to confirm that you accept that your confidential information can be shared. This will be to support you on the Working Well (Work and Health) Programme and with other health specialists. They will only share the relevant information and you can withdraw your consent at any time.

Your Health Professional will work with your Keyworker to support you on the Woking Well (Work and Health) Programme. In doing this they will:

  • Discuss and make sure the correct jobs are offered to you. Provide return to work advice and guidance for you and your Keyworker.
  • Carry out pre-work assessments (in addition to the ones carried out by the Key Worker). This will help them to make recommendations such as equipment needs, along with detail on how to plan and manage your move in to work.
  • Provide in-work support. This is targeted towards helping you with any difficulties you have during your time in work.
  • Where needed, contribute to the development of your action plan. Making sure that their health-related recommendations are included correctly in your action plan, by your Keyworker.

Working with other health professionals

While helping you on the programme the Health Team may require some further information. This could be from your GP, other Health Professionals or specialist organisations. This would be to make sure that everyone supporting you with your health issues is working together. Your GP or other Health Professional who they speak to may provide supporting information. If they do, it would be to improve your support on the Working Well (Work and Health) Programme.

A copy of any letters or emails that have been sent to other Health Professionals can be shown to you on request. You can also request the details of any discussions that have taken place about your health support. These will be held as confidential case notes by the health professionals.

Referral to external services

Your Health Professional may advise you to go to another external service that they think will help you. If they need to do this, it would be helpful to share your information required by the service with the relevant person/organisation. Before any referral or sharing, your Health Professional would discuss the reason with you, and record this. You would have the option to refuse the referral during the discussion and in most instances, we will require your consent to share your health information.

Other Ad-Hoc Sharing

  • Fraud detection and prevention - By law, each organisation must protect the public funds they are responsible for. Therefore, in certain circumstances we may be legally required to share personal information with other organisations, such as the DWP, HM Revenue and Customs, the police and other law enforcement agencies for the purposes of the detection and prevention of crime and fraud.
  • Emergency Services - We may contact emergency services or your GP, to assist you, or provide emergency response management support in high-risk situations. Where possible this will be carried out with your consent, however your consent may be overridden where we believe you are a danger to yourself or others.
  • Financial/Audit purposes - We are also required to share information with the European Social Fund for financial and audit purposes.

Ingeus UK cannot process your information without having a valid, lawful reason for doing so.  For further details about the organisations we share with and the legal basis we have for sharing this data please see below.

Research and evaluation

At Ingeus UK Ltd we pride ourselves on continuously improving the services provided to you and others. We identify areas for improvement by conducting research and evaluation of existing services. One way in which we do this is to convert your personal data into statistical or aggregated data, which is then used to produce statistical research and reports.

As part of the Woking Well (Work and Health) Programme your data will be provided to the GMCA so as one of the organisations funding the programme, they can do their own review. They will be looking to see how well the programme has worked, for the people that have taken part.  They will then use this information to improve and identify the best services to fund all across Greater Manchester.

Also, none of the work produced as part of the GMCA evaluation will be used to make any decisions about you. It will be used for improving the quality, effectiveness and delivery of help across Greater Manchester.

SQW Limited will be carrying out the evaluation work for GMCA. Where we would like you to provide additional information to SQW, via focus groups, telephone interviews or feedback forms, we will always ask if you are willing to take part in these.

The GMCA has a contract with SQW Limited which makes them legally responsible to look after your information properly and ensure that it is kept securely and only the right people can see and use it for the research.

You do have the right to object to your identifiable information including health information used in this way. However, supporting the improvement in services as explained above is important. It helps make services better for you and your communities. We hope that you will be happy for us to use your information for the evaluation. However, if you are not, please make your Keyworker aware and we will process your objection in line with the Data Protection Legislation requirements.

Consent

Where we need your agreement to process your information, for example, by passing your contact details to a third party who is not a contracted Delivery Partner, we will ask you to provide your consent first. We will explain why your consent is needed and the information that we will share, this information will be provided verbally or via a consent form. Where verbal or written consent is provided, this will be recorded on our systems for tracking purposes.

Right to Withdraw Consent

Where you have consented for us to share your information with a specific organisation or individual, you have the right to withdraw your consent at any time. Should you wish to withdraw your consent, please speak to your Keyworker who will update our records, or, send a written request to the Data Protection Officer who will process your request.

Protecting your information

Ingeus UK Ltd is committed to protecting the confidentiality and security of your information. We ensure that your personal information is processed lawfully and respectfully, ensuring that we are always compliant with data protection laws and information security standards, for example, the General Data Protection Regulation (GDPR), Data Protection Act 2018 and ISO27001 (an information security standard).

We have appropriate security measures in place to prevent personal information from being accidentally lost, or, used or accessed in an unauthorised way. We limit access to your personal data to those who have a genuine business need to see it. Those processing your information will do so only in an authorised manner and are subject to a duty of confidentiality. We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so.

All Ingeus UK Ltd staff are required to complete mandatory data protection and information security training to ensure they understand their responsibilities in relation to processing your personal information. Internal and external audits are also undertaken to ensure that data protection laws are being complied with.

Keeping your information

Ingeus UK Ltd and our Delivery Partners are required to retain your information as part of our contractual and legal obligations. There are many different laws that we must comply with in order to provide you with the services and support you need. However, we will not retain your information for any longer than is necessary and where we are no longer required to keep your information, it will be safely and securely destroyed.

The following table provides you with information on how long we keep your information.

Type of Information

Length of time

Your participant file

31st December 2027

Information about convictions relating to serious sexual offences (MAPPA file)

Until the end of the programme (15 months after the start of the programme, or, 21 months from your start date should you become employed)

Information relating to fraud or any legal complaints you have made against us

For as long as we reasonably consider that you might legally bring an additional or repeat claim against us or to meet other statutory obligations

Financial information relating to payments we have made to you whilst on the programme

6 years following the end of the tax year

Information to be used to support European Social Funding and their audits

22 years after the end of the Programme.

Statistical and anonymised data that has come from your personal information.

This data would not be considered personal information and will be kept as long as is necessary to support this and similar programmes in Greater Manchester and Nationally.

 

Your Individual Rights

The GDPR grants you certain rights in regards to your personal information, and the way in which it is processed. This gives you more control over what organisations are doing with your information. These rights are:

  • To be informed
  • To access your personal data
  • To correct/ erase personal data
  • To restrict how we use personal data
  • To object to how we use personal information
  • To ask us to transfer personal data to another organisation
  • To object to automated decision making including profiling
  • To understand how we protect information transferred outside of the European Economic Area

To find out more about how we use personal data we may ask you to prove your identity when making a request to exercise any of these rights. We do this to ensure we only disclose information where we know we are dealing with the right individual.

We aim to respond to all valid requests within one month. It may however take us longer if the request is particularly complicated or you have made several requests. We will always let you know if we think a response will take longer than one month.

We may not always be able to fully address your request, for example if it would impact the duty of confidentiality we owe to others, or if we are otherwise legally entitled to deal with the request in a different way.

The right to be informed

Ingeus UK Ltd is committed to ensuring that you are always aware of what we are doing with your personal information and are kept informed of any changes to the processing of it. We do so through this Privacy Notice, which is reviewed and updated as and when required.

The right of access

You have the right to ask for a copy of the personal information we hold about you. This is known as a Subject Access Request. When requesting your personal information, you will need to include the following information:

  • your full name, address and contact telephone number;
  • any information used by the organisation to identify or distinguish you from others of the same name (account numbers, unique ID's etc);
  • details of the specific information you require and any relevant dates

The right to rectification

We endeavour to ensure that the information we hold about you is always accurate. However, there may be instances where the information we hold is no longer up to date. You can ask that we rectify any information about you that is incorrect. We would be happy to rectify such information but may need to verify the accuracy of the information first. Please speak to your Keyworker so that any inaccuracies can be looked in to and corrected where necessary.

The right to erasure

You have the right to request that certain personal information be erased from our systems if you feel that there is an underlying legal issue to us processing your information, or, where you withdraw your consent to us processing that information.

While you may request for your information to be erased, this does not mean that we will be able to comply with your request, as there may be a legal reason that we have to keep your information. As such, each request is considered on a case-by-case basis.

The right to restrict processing

You have the right to request that we ‘restrict’ the processing of your personal information, for example, if you are unsatisfied about the accuracy of the data and we undertake an investigation. We can continue to use your personal data following a request for restriction where we need to use it to establish, exercise or defend legal claims, or we need to use it to protect the rights of another individual or the company.

The right to transfer data to another organisation (portability)

You have the right to request us to provide you with a copy of the personal information that you have provided to us, and which we process electronically. The data must be in a machine-readable format that facilitates transmission from controller-to-controller. This allows you further use of the data and enables you to move between service providers without any loss of data.

While you may request data portability, this does not necessarily mean that we will be able to comply with your request, as there may be reasons that we are unable to comply with your request. As such, each request is considered on a case-by-case basis.

The right to object to how we use personal information

You have the right to object to us processing your personal information for the following reasons:

  • Direct marketing,
  • Scientific/historical research and statistics,
  • Legitimate interests and processing in regards to the performance of a public interest or official authority task.

While you may object, this does not necessarily mean that we will be able to comply with your request, as there may be reasons that we are unable to comply, such as other legal obligations. Each request is considered on a case-by-case basis.

The right to object to automated decision making, including profiling

We do not carry out any automated decision making or profiling.

Transfers outside of the European Economic Area (EEA)

We do not transfer any of your data outside of the EEA.

Exercising your rights

If you wish to exercise any of the above rights, you can tell your Keyworker who will start the process for you. Alternatively, you can make the request by writing to:

Data Protection Officer, Ingeus UK Ltd, Second Floor, 66-68 East Smithfield, Royal Pharmaceutical Building, London, E1W 1AW 

Or you can email us at: DataProtectionOfficer@ingeus.co.uk

Please ensure that you let us have enough information to identify you, e.g.name, address, date of birth, your Keyworker details, and let us know the information which your request relates to.

Contact Us

Please contact our Data Protection Officer if you have any questions about this privacy notice or the information we hold about you.

  • Data Protection Officer, Ingeus UK Ltd, Second Floor, 66-68 East Smithfield, Royal Pharmaceutical Building, London, E1W 1AW 
  • Email us at: DataProtectionOfficer@ingeus.co.uk

If you have any concerns about the way that your information is being processed, or feel your information is not being used appropriately, please raise your concerns with the Data Protection Officer, explaining what your specific concerns are. The Data Protection Officer will then investigate your concerns you have raised.

If you remain unsatisfied after the investigation by the Data Protection Officer and their response to you, you may raise a concern with the Information Commissioner’s Office:

  • Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
  • www.ico.org.uk

Review of this Privacy Notice

We review this Privacy Notice to ensure we keep you up to date about what we are doing with your personal information and any changes in our processing of it. This privacy notice was last updated on 16th January 2020.

Legal Basis for processing your personal information

 

Type of Organisation information is shared with

The type of information

What we use your information for

The lawful reason that we have identified to process your information

Jobcentre Plus (JCP) / DWP
  • Full data set, including information such as name, contact details, date of birth, NI number.
  • Special category information, such as information which relates to your health and/or disability Gender, Religion, Ethnicity, Sexual Orientation, Criminal Convictions.
  • Qualifications, job goals, employment history.
  • Marital Status and family circumstances.
  • ID check and right to work
  • Information collected during your time on the programme, such as correspondence, customer feedback forms, welcome pack declaration, C.V, consent forms, start forms, exit forms etc.
  • To develop a personalised action plan and tailored package of ongoing support.
  • To identify employment needs, match skills to available work, connect. participants with employers, provide in work support to gain sustained employment, provide training and help manage health problems to reduce their impact on work.
  • Through partner organisations, to develop skills, confidence and improve the health and wellbeing of participants.

Art 6 (1)(e) - Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

Section 13(1)(b)(iv) and 1A of the Social Security (Claims and Information) Regulations 1999 enables DWP to share social security and employment and training information with relevant authorities and their service providers in connection with any arrangements made by the recipient for purposes connected with employment and training.

Art 9 (2)(b) processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law in so far as it is authorised by Union or Member State law.

Other grounds which may apply include Art 9 (2)(h), 9 (2)(i) and Art 9 (2)(j) - see below.

European Social Fund (ESF)

Programme start, eligibility, claims and contractual information.

For audit purposes and to meet contractual requirements

Art 6 (1)(e) - Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

Art 9 (2)(b) processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law in so far as it is authorised by Union or Member State law.

Other grounds which may apply include Art 9 (2)(h), 9 (2)(i) and Art 9 (2)(j)

Her Majesty’s Revenue & Customs

Employer information to verify outcomes from the WHP. Additionally, we may share information received indicating any fraudulent behaviour.

To ensure we can claim for payments associated with participants moving into work, and to comply with DWP provider guidance.

Art 6 (1)(e) - Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

Processing of personal data relating to criminal convictions and offences are likely to fall within the permitted parameters of processing referred to in Art 10 of the GDPR i.e. this processing shall 'be carried out only under the control of official authority or when the processing is authorised by Union or Member State law providing for the appropriate safeguards of the rights and freedoms of data subjects.'

The Greater Manchester Combined Authority (GMCA)

As for DWP and JCP. Additionally, we may also share data with GMCA for auditing and claims purposes.

GMCA is the Lead Authority responsible for delivering the Work and Health Programme to Participants in the Greater Manchester area.

Art 6 (1)(e) - Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

Art 9 (2)(b) processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law in so far as it is authorised by Union or Member State law.

Other grounds which may apply include Art 9 (2)(g), (2)(h), 9 (2)(i) and Art 9 (2)(j).

Direct Delivery partners: The Growth Company, Pluss and Pathways

As for DWP and JCP.

Supply Chain partners deliver employment services on behalf of Ingeus to DWP claimants, and eligible non-claimant, customers under subcontracts for Work and Health Programme (WHP) Contract in the Greater Manchester area.

Art 6 (1)(e) - Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

Art 9 (2)(b) processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law in so far as it is authorised by Union or Member State law.

Other grounds which may apply include Art 9 (2)(h), 9 (2)(i) and Art 9 (2)(j) - see below.

Ad- hoc Delivery Partners (such as specialist medical service providers)

Limited data set i.e. name, contact information and details of any reasonable adjustments that may be required in order to deliver the service.

Clinical/medical information may be provided to medical professionals as required.

Service Level Agreements are in place with Partners, which covers the sharing of information for spot purchases of particular services relevant to participants. GMCA Partners may also provide interpreters.

Art 6 (1)(a) – the data subject has given consent to the processing of his or her personal data for one or more specific purposes

Art 6 (1)(e) - Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

Art 9 (2)(a) – Explicit consent provided by participant.

Other grounds which may apply include Art 9 (2)(b), (2)(h), 9 (2)(i) and Art 9 (2)(j) - see below.

Probation Officers (NPS or Community Rehabilitation Company) or Police

Full data set including licence conditions, and if MAPPA notification applies - receive paper records.

To deliver the Work and Health Programme to probation Participants.

Art 6 (1)(d) - processing is necessary to protect the vital interests of the data subject or another natural person;

Art 6 (1)(c) - processing is necessary for compliance with a legal obligation to which the controller is subject

Art 9 (2)(b) - processing is necessary for the obligations and rights in the field of employment and social protection

Art 9 (2)(g) processing is necessary in the substantial public interest

Art 9 (2)(f) - Processing is necessary where the courts are acting in their legal capacity (in order to carry out the court's sentence)

Employers

Limited personal data – names, and potentially a description of any disability.

For the purpose of assisting participants to get a job placement. Participant names might be shared with employers when participants move into work. To confirm / verify employment outcomes.

Art 6 (1)(e) - Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

Art 9 (2)(b) processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law in so far as it is authorised by Union or Member State law.

Other Ingeus entities providing IT or management services (Ingeus Europe Limited)

Full data set as for GMCA and JCP/DWP

Nominated Ingeus Europe staff will have access to full data set including Participant data and staff data to provide IT and/or management support.

Art 6 (1)(e) - Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

Art 9 (2)(b) processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law in so far as it is authorised by Union or Member State law.

GP / Safeguarding Authorities

Limited personal data set provided for the purposes of reporting an incident, concern or emergency.

Reporting incidents or issues arising from participants on the programme as required by law.

Art 6 (1)(c) - processing is necessary to comply with a legal obligation to which the controller is subject.

Art 6 (1)(d) – processing is necessary in order to protect the vital interests of the data subject or another natural person.

Art 9 (2)(c) - processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent

Art 9 (2)(g) - processing is necessary, on the basis of Member State law to safeguard the fundamental rights and the interests of the data subject.

Art 9 (2)(h) - processing is necessary for the purposes of preventative or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional

Insurers

Data required to describe to nature of the claim. This may be quite detailed depending on the allegation made / being defended/prosecuted.

It is possible that participants or third parties may bring claims or suffer incidents while participating on the programme. We are required to disclose any such incidents to our insurers.

Art 6 (1)(f) - processing is necessary to protect the legitimate interests of the data controller

Art 9 (2)(f) - processing is necessary for the establishment and defence of legal claims

Research & Evaluation (GMCA & SQW Limited)

Data such as information which relates to your health and/or disability Gender, Religion, Ethnicity, Sexual Orientation, Criminal Convictions.

 Qualifications, job goals, employment history, housing circumstances,

 Marital Status and family circumstances. It will also include the results of any assessments you have undertaken with your Keyworker.

You may also be asked to help with more detailed research (such as telephone interviews, feedback forms or focus groups). This would include providing similar information and assessment data as above.

To assess the effectiveness of the programme and identify areas to improve services.

It will be used for improving the quality, effectiveness and delivery of help across Greater Manchester.

Art 6 (1)(e) - Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

Art 9 (2) (j) - processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) based on Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.