Privacy Policy
1 Introduction
Cultivator is a business support programme for the creative industries of Cornwall and the Isles of Scilly, delivered by Creative Skills which is part of Creative Kernow. It is funded by the European Union, through a European Regional Development Fund (ERDF) contract with the Ministry for Housing, Communities and Local Government (MHCLG) and a European Social Fund (ESF) contract with the Department of Work and Pensions (DWP). The programme is match-funded by Arts Council England (ACE) and Cornwall Council.
Cultivator (‘we’), as the data processor, are committed to keeping any personal information you give us safe. We respect your privacy and are committed to protecting your personal information.
This privacy policy expands on the Creative Kernow Privacy Notice (https://www.creativekernow.org.uk/privacy-notice/ ) and incorporates content from the DWP and MHCLG Privacy Notices. It explains how we collect, process and look after the personal information you have given us, tells you about your privacy rights and how the law protects you. Please read this privacy policy carefully.
2 What do we mean by ‘personal information’?
Personal information means any information which identifies (or is capable of identifying) you as an individual. This might include your name, business name, email address, contact telephone numbers, private / business address, financial information and details of your requirements for business support / advice.
We also collect Special Categories of Personal Information, for example ethnicity, age and disability.
3 How do we collect personal information?
We may collect personal information about you in several ways:
- When you complete an Initial Contact Form
- When you complete a Development Needs Analysis Form
- When you apply for / participate in a specific strand of support
- Subscribe to our Newsletter
- When you contact us via our website
A word about websites
Like most website operators, Cultivator collects non-personally-identifying information of the sort that web browsers and servers typically make available, such as the browser type, language preference, referring site, and the date and time of each visitor request. We collect this non-personally-identifying information to better understand how visitors use our website. From time to time, we may release non-personally-identifying information in the aggregate, e.g. by publishing a report on trends in the usage of our website.
Some visitors to our website choose to interact with them in ways that require us to gather personally-identifying information. The amount and type of information that we gather depends on the nature of the interaction. In each case, Cultivator collects such information only insofar as is necessary or appropriate to fulfil the purpose of the visitor’s interaction with the site.
Cookies are used on Cultivator’s website to enable some services to recognise your device so you don’t have to give the same information several times during one task and to provide Cultivator with information to help improve the experience of using our website.
4 How we use your personal information
Legally there are a number of different reasons why personal information may be collected and processed. The main legal bases under which Cultivator collects and processes your personal information are:
Consent – We can collect personal information with your consent – for example when you sign up to our newsletter.
Contractual Obligation – We can collect personal information in order to comply with a contractual obligation – for example when delivering support to you as part of a publicly funded programme.
Legitimate Interest – Where it is necessary in order for an organisation to perform its activities in ways that might be reasonably expected and where such collection and processing doesn’t impact a person’s rights, freedoms or interests.
Other legal bases include:
Public Interest – to deliver work on behalf of public bodies (e.g. the European Union, ACE, Cornwall Council).
Legal compliance – if we are required to by law – for example passing on details of individuals involved in fraud or other criminal activity against Cultivator to a law enforcement agency.
With your consent and/or as part of our contractual obligations and/or if it is necessary for our legitimate interest we will use your personal information to provide you with the information or support services you have requested
5 Sharing your personal information
We will only share your personal information with:
- Our funders and/or their Managing Authorities – listed here – by reason of our contractual obligations:
Ministry of Housing, Communities & Local Government (MHCLG) – appointed Managing Authority for the ERDF and its auditors (including European auditors). Please see MHCLG’s Privacy Notice included below.
Department of Work & Pensions (DWP) appointed Managing Authority for the ESF and its auditors (including European auditors). Please see details of DWP’s Privacy Notice included below.
Arts Council England
Cornwall Council
- Our Project Partners – listed here – by reason of legitimate interest:
University of Plymouth
Real Ideas Organisation
Cornwall College
Business West
Cornwall Museums Partnership
- Creative Kernow ’s financial auditors and its IT support contractor who abides by the Creative Kernow Privacy Notice.
- The Cornwall & Isles of Scilly Growth Hub, a business support provider with a support co-ordination role, by reason of legitimate interest.
Other third parties, including providers of business support, knowledge exchange or relevant educational provision will only be granted access to your information if explicit prior permission has been obtained from you.
Privacy Notice for the Purpose of Data Collection for ERDF
The EU Common Provisions Regulations (CPR) and Article 6 of the ERDF Regulation require the MHCLG, as the Managing Authority for the programme, to monitor and evaluate ERDF-funded activities. In order to conduct monitoring and evaluation (including the summative assessment) and to ensure compliance, the collection of personal data is required.
Who is the data controller for ERDF personal data?
The MHCLG ERDF Managing Authority is the controller for all personal data required to help deliver the ERDF programme under the terms of its ERDF Funding Agreement.
The MHCLG ERDF Managing Authority will be processing personal data in the ERDF programme according to the following lawful basis:
Article 6(1)(e) of the EU General Data Protection Regulation (GDPR)
‘processing is necessary for the performance of a task carried out in the public
interest or in the exercise of official authority vested in the controller’.
The lawful basis for controlling or processing `special category’ data under ERDF is:
Article 9(2)(g) GDPR
“processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide suitable and specific measures to safeguard the fundamental rights and the interests of the data subject;”
What personal data will be collected?
Depending on the nature of activities of the ERDF-funded project and the indicators listed under each activity, the following information for each direct or indirect beneficiary where these are individuals may be collected:
- Name of contact point within a business (in some cases property owner) engaged with or individual engaged with;
- Address
- Postcode
- Phone number
- Ethnicity
- Disability
- Email address
- Labour market status prior to receiving support and 6 months after receiving support
- Duration of support
- Intensity of support
- Pay details
MHCLG may collect special category data on ethnicity and disability.
Who will my personal data be shared with and how will it be used?
Your details will be stored securely and retained in compliance with GDPR and the new Data Protection Act. This information will be used to evaluate this project and to report to the European Regional Development Fund for monitoring and evaluation purposes.
Your details will be used to support the ERDF programme research and evaluation activities. MHCLG will need to share all or some of your personal data with the national evaluator of the ERDF programme. In some cases, the national evaluator, i.e. independent external contractors commissioned by DCLG, may use the contact details to contact a sample of direct or indirect beneficiaries for the purpose of the National Evaluation of the programme. It is likely that the survey methodology will need to incorporate a variety of approaches in order to maximise the survey response rate (for example, telephone survey, written survey, and e-mail survey) – hence the need for a variety of contact details required for each participant. MHCLG may also need to share with other government departments and the European Commission where this is necessary to test the robustness of the data gathered or to inform the National Evaluation.
MHCLG will not give any personal data to any other organisation unless needed for the purpose of the evaluation and will instruct them not to use it to contact individuals for any reasons not connected with the purpose of the National Evaluation of the ERDF programme 2014-2020 or other matters directly relating to the evaluation. If MHCLG has to pass on the data, it will only provide what is needed, and if possible will remove the details that might identify individuals personally. MCHLG will not transfer personal data outside the European Union, to third countries or international organisations.
MHCLG will not keep your personal data for longer than it needs but as a minimum, will retain data for two years after the closure of the 2014-2020 ERDF programme in line with the European Regional Development Fund document retention guidance to ensure MHCLG meets reporting obligations and to demonstrate compliance with EU
Requirements.
Individual’s rights
ERDF participants cannot claim the following rights in terms of ERDF personal data:
- right to erasure (“right to be forgotten”)
- right to portability of their data
The data collected is your personal data, and you have the right, subject to lawful data requirements:
- to see what data we have about you;
- to ask us to stop using your data;
- to ask us to delete your data, or to correct your data if there is no longer a justification to process it;
- to lodge a complaint with the independent Information Commissioner (ICO) if you think we are not handling your data fairly or in accordance with the law.
Automated decision making
Your personal data will not be subjected to automated decision making
Contact Details
You can contact the ICO at Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
Tel: 0303 123 1113
Email: [email protected]
If you would like further information about the programme and your personal information please contact the ERDF Programme at: [email protected]
Participant Privacy Notice for the Purpose of Data Collection for ESF
The full DWP Privacy Notice in relation to ESF personal information can be found here: https://www.gov.uk/government/organisations/department-for-work-pensions/about/personal-information-charter.
DWP’s purposes in personal information processing
The information you provide Cultivator will be shared with the DWP and used to evaluate this project and to report to Cultivator and the ESF for monitoring purposes, in line with European Commission regulatory requirements.
Your information will also be shared with research organisations working on behalf of DWP who may contact you to discuss your involvement in the project for research purposes. Participation in research is voluntary and you will be asked to consent before taking part in any research activity you may be contacted about.
The DWP may also link your personal details to official administrative records in order to monitor your employment status before your ESF support began and 6 to 12 months after you left. This information may also be shared with research organisations working on behalf of the DWP. However, individuals will not be identifiable and you will not be contacted about this research.
Data will not be used or shared for any commercial or marketing purposes.
At all times your information will be kept securely, and nobody will have access to it that shouldn’t.
DWP’s lawful basis for personal information processing
For the purposes of the General Data Protection Regulation (GDPR), the DWP is the data controller in respect to information processed which relates to all participation in the ESF. ESF grant beneficiary organisations are data processors in respect to information processed which relates to participants in the operations and projects funded by the ESF.
DWP is not the controller for any other/additional data collected by Cultivator that is not essential for delivering the ESF programme, or for any personal information that would normally be collected anyway by Cultivator.
The ESF Programme Action Note 018/18 sets out the lawful basis for processing personal data under ESF.
DWP’s retention periods for the personal information
All personal data held by DWP or research contractors for the purposes of evaluation will be permanently deleted no more than six months after the research has been completed (i.e. when the final report is published on GOV.UK).
Personal data held by DWP for all other ESF purposes as required by European Commission regulations will be retained in line with the current guidance on GOV.UK at:
Rights available to individuals in respect of information processing
If you do not wish your personal data to be used for ESF evaluation purposes please contact [email protected] and we will delete your data held for these purposes and you won’t be contacted about participating in research.
More information about how and why DWP uses your personal information, including how to ask for a copy of the personal information DWP holds about you can be found in DWP’s Personal Information Charter at:
Information about how to ask for a copy of the information DWP holds about you (known as a ‘Right of Access Request’) can be found at:
7 Security of your personal information
Creative Kernow has appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed.
Creative Kernow has procedures to deal with any suspected personal information breach and will notify you, MHCLG & DWP and the Information Commissioner’s Office (ICO) as legally required to do so.
8 Keeping your personal information
We will only keep your personal information for as long as necessary to fulfil the purposes we collected it for, this includes satisfying any legal, accounting, or reporting requirements.
Information will be held until 31 December 2033 as required by our contracts with MHCLG and DWP.
9 Your Legal Rights
Individuals have rights under the GDPR in relation to their personal information. More detail on these rights can be found here: https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/.
You have the right to:
Request access to your personal data, commonly known as a ‘Right of Access Request’ (RAR). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it. Further information on RARs can be found here: https://www.gov.uk/government/publications/dwp-request-for-personal-information
Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.
Request erasure of your personal data. This is ‘the right to be forgotten’ and enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. However, we may not always be able to delete your data for specific reasons which will we will explain, if applicable, at the time of your request.
Further rights include:
- The right to object to processing.
- The right to restrict processing of your personal data.
- The right to data portability
- The right to be informed
- The right to withdraw consent
- Rights in relation to automated decision making and profiling
However ERDF and ESF regulations may restrict some of these rights.
If you wish to exercise any of the rights set out above, please contact us at [email protected] . We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it.
Once we have received your request we will comply or explain why we cannot comply within 30 days.
10 Changes
It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.
Although any changes are likely to be minor, Cultivator may change its Privacy Policy from time to time. We encourage participants of the Cultivator programme to check its website frequently for any changes to the Privacy Policy.
Creative Kernow is registered with the ICO – Information Commissioner’s Office – registration number Z5040163
Cultivator is a project of Creative Kernow, Charity Number 292138. VAT: 923 2445 42. Registered Address: Krowji, West Park, Redruth, TR15 3AJ