General Privacy Notice – COVID-19 NHS Track & Trace

You may be asked to provide some basic information and contact details to HSDC. HSDC will disclose your information to NHS Test & Trace if you have agreed to share it with them.

HSDC will collect the following personal data:

Information about staff:

• the names of staff who work at HSDC
• a contact phone number for each member of staff
• the dates and times that staff are at work

Information about customers and visitors:

• the names of all customers or visitors, or if it is a group of people, the name of one member of the group
• a contact phone number for each customer or visitor, or for the lead member of a group of people
• date of visit and arrival and departure time
  • In addition, if a person/group only interacts with one member of staff during their visit, the name of the assigned staff member will be recorded alongside that information.
  • HSDC will only request these records where it is necessary for NHS Test and Trace.

We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:

• To manage attendance in HSDC’s buildings as part of our COVID-19 mitigation measures
• Where requested by the NHS as part of its Test and Trace service

You can find details on how NHS Test and Trace uses personal data on the NHS Test and Trace website.

Your personal data will be collected and processed primarily by our staff and HSDC (access to your personal information is limited to staff who have a need-to-know need to see it for the purpose of carrying out their job at HSDC.). We may have to share your personal data with the parties set out below for the purposes outlined in section 4:

• NHS Test and Trace

Data Protection Legislation requires that we meet certain conditions before we are allowed to use your data in the manner described in this notice, including having a “lawful basis” for the processing. The basis for processing will be as follows:

• Public task. The processing of your personal data may be necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us (Article 6(1)(e) of GDPR).

We do not transfer your personal data outside the European Economic Area (EEA).  

Information collected as part of this contact-tracing initiative will be stored securely and lawfully, and by NHS Test and Trace (if passed to them), in line with the requirements of the GDPR and Data Protection Act 2018.

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. Your data that is collected for NHS Test and Trace will be retained locally for 21 days after your visit, at which point it will be deleted or destroyed.

Where your data is passed to NHS Test and Trace in the case of a suspected outbreak, your information will be kept for up to eight years, as part of the standard contact-tracing retention period set out by PHE.

Under certain circumstances, you may have the following rights under data protection legislation in relation to your personal data:

• Right to request access to your personal data;
• Right to request correction of your personal data;
• Right to request erasure of your personal data;
• Right to object to processing of your personal data;
• Right to request restriction of the processing your personal data;
• Right to request the transfer of your personal data; and
• Right to withdraw consent.

If you wish to exercise any of these rights, please contact the Data Protection Office at DataProtection@hsdc.ac.uk.

You can contact HSDC by telephoning 023 9387 9999 or by writing to:

HSDC
Alton Campus: Old Odiham Rd, Alton GU34 2LX
Havant Campus: New Road, Havant, Hampshire, PO9 1QL
South Downs Campus: College Road, Waterlooville, Hampshire, PO7 8AA

Please note that HSDC has appointed a Data Protection Officer. If you have any questions about this Privacy Notice, including any requests to exercise your legal rights, please contact our Data Protection Officer using the details set out below:

Data Protection Officer: DataProtection@hsdc.ac.uk

If you wish to complain about our use of personal data, please send an email with the details of your complaint to the Data Protection Officer so that we can look into the issue and respond to you.

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) (the UK data protection regulator). For further information on your rights and how to complain to the ICO, please refer to the ICO website.