Privacy Notices

Service being provided

Facilitation and administration of volunteering and work‑experience opportunities within Worcester City Council and affiliated volunteering programmes and projects (for example, Trees for Cities). This includes placement coordination, safeguarding, and ongoing support.

Categories of personal data we collect

• Name
• Address
• Contact details
• Date of birth
• Financial information for processing expenses payments (where required)
• Emergency contact details
• Identification documents (such as passport or driving licence, where required)
• National Insurance number (where required)
• Parental consent (where required)

Special Category or Criminal Offence data we collect

• Equality monitoring (where necessary)
• Disability or medical information (where necessary to support reasonable adjustments, health and safety, or welfare)
• Criminal offence data (where roles require suitability checks, including Disclosure and Barring Service (DBS) checks)

Criminal offence data is processed in accordance with Article 10 UK GDPR and the Data Protection Act 2018, with appropriate safeguards in place.

Consequences of failing to provide personal data

If required personal data is not provided, we may be unable to offer or continue a volunteering or work‑experience placement, particularly where safeguarding, health and safety, or insurance requirements apply.

Data Controller and Processors

The Data Controller is Worcester City Council. 

The Data Protection Officer for Worcester City Council can be contacted at This email address is being protected from spambots. You need JavaScript enabled to view it.

Malvern Hills District Council is a Data Processor when processing payments.

Purpose of Processing

• Coordinate volunteering and work‑experience opportunities
• Carry out safeguarding and suitability checks where required 
• Meet health and safety obligations 
• Ensure accessibility and reasonable adjustments
• Liaise with placement partners, schools, or educational institutions
• Manage participation and provide appropriate support
• Process and verify volunteer expenses, including audit and financial control.

Lawful basis for processing personal data

• Article 6(1)(e) UK GDPR – Public task, where processing is necessary to deliver community engagement, volunteering, and educational functions; and 
• Article 6(1)(c) UK GDPR – Legal obligation, where required for safeguarding, health and safety, or regulatory duties.

Lawful basis for processing special and criminal offence category data

• Article 9(2)(b) UK GDPR – employment and social‑protection‑style processing (applied appropriately to volunteers), and/or
• Article 9(2)(g) UK GDPR, supported by Schedule 1 of the Data Protection Act 2018 (safeguarding and protection of individuals); and
• Article 10 UK GDPR for criminal offence data.

Source of data

• The individual 
• Parents or guardians (where the individual is under 18) 
• Schools, colleges, or universities 
• Voluntary‑sector partners or project organisations

Who we share the information with

Personal data may be shared where necessary and lawful, including with:

• project partners supporting volunteering placements
• schools or educational institutions (for work experience)
• safeguarding partners or DBS service providers
• Malvern Hills District Council (for processing expenses payments for volunteers)

Information is shared only where required to support placement delivery, safeguarding, or legal duties.

Details of data transfers outside the UK and safeguards in place

We do not routinely transfer data outside of the UK. Where personal data is transferred outside the UK, appropriate safeguards are in place, such as adequacy regulations or approved contractual clauses.

Automated decision-making

We do not carry out automated decision-making or profiling in relation to this processing.

How long we hold your information

The information outlined in this privacy notice will be kept for a minimum of 6 years in accordance with our retention schedule taking into account safeguarding and audit requirements. All information will be held securely and destroyed under confidential conditions.

Your rights

You have rights under UK GDPR, including the right to:

• access your personal information
• ask us to correct incorrect or incomplete information
• ask for your information to be deleted (in certain circumstances)
• restrict how your information is used
• object to certain uses of your information
• request your information in a commonly used format (data portability)
• understand and challenge automated decisions and profiling.

Some rights may be limited where processing is required for safeguarding or legal obligations.

Individual’s right to withdraw consent at any time

Where your personal information is processed on the basis of consent (e.g. audio or video recordings), you have the right to withdraw this consent at any time.

Complaints and further information

If you have questions or concerns about how your information is used, please contact the Data Protection Officer:

Email:        This email address is being protected from spambots. You need JavaScript enabled to view it. 
Phone:      01905 722233

Postal address:  

Data Protection Officer
Worcester City Council
The Guildhall
High Street
Worcester
WR1 2EY

If you remain dissatisfied, you have the right to complain to the Information Commissioner’s Office (ICO):

Website:   https://www.ico.org.uk 

Phone:      0303 123 1113

Postal address:   

Information Commissioner's Office,
Wycliffe House,
Water Lane,
Wilmslow,
Cheshire,
SK9 5AF

Changes to this notice

We may update this privacy notice from time to time. The latest version will always be available on our website.

Service being provided

Maintaining the Threatening and Abusive Behaviour (TAB) Register to provide staff with relevant and proportionate information on service users to keep them safe whilst providing council services.

Categories of personal data we collect

• Name
• Postcode
• Gender

Special Category data we collecy

• Medical (where relevant)
• Information about behaviour, incidents, risks or reasonable adjustments, only where relevant to assessing and managing staff safety.

Source of data

We collect personal information:

• directly from you
• from managers or supervisors
• from incident or accident reports

In some cases, information may also be provided by emergency services, insurers, or other organisations involved in an incident.

Consequences of failing to provide personal data

This notice explains how we use personal information where it is necessary and proportionate to protect employees, contractors and others delivering council services from a reasonably foreseeable risk of harm. The register is not based on consent; where information is recorded, we will use the minimum information needed to assess and manage the risk.

Data Controller and Processors

The Data Controller is Worcester City Council. 

The Data Protection Officer for Worcester City Council can be contacted at This email address is being protected from spambots. You need JavaScript enabled to view it.  

Purpose of Processing 

• To allow authorised staff to check relevant locations, such as postcode or street name, before providing a service and identify whether there is a recorded and current risk associated with a service user or address.
• To allow adequate risk assessments to be carried out prior to service provision.
• To allow a continuation of service provision with appropriate measures in place.

Lawful basis for processing personal data

• Article 6(1)(e) – Public task, where processing is necessary for Worcester City Council to perform its official functions in delivering council services safely and managing risks to employees and others.
• Where a specific activity is not part of the Council’s public task, we may rely on Article 6(1)(f) – legitimate interests. In those cases, the legitimate interest is protecting employees and others from harm and we will complete and keep a legitimate interests assessment showing that the processing is necessary, proportionate and balanced against the individual’s rights and freedoms.

Lawful basis for processing special category data

• Article 9(2)(b) – employment, social security and social protection, where processing is necessary to meet legal obligations and exercise rights connected with employment and health and safety; and/or Article 9(2)(g) – substantial public interest, where applicable.
• Data Protection Act 2018, Schedule 1, Part 1, paragraph 1 – employment, social security and social protection; and, where relevant, Schedule 1, Part 2 conditions such as paragraph 18 – safeguarding of children and individuals at risk. We will maintain an appropriate policy document where required.

Who we share the information with

The TAB register is an internal only system. The information recorded in it is only shared on a need-to-know basis with internal teams where relevant to their role.

Access is restricted to authorised staff who need the information to assess and manage risk. We will not share more information than is necessary for the specific service interaction, and information will not be used for unrelated purposes.

Automated decision-making

We do not use automated decision-making or profiling in relation to this processing.

How long we hold your information

We will only keep your information for the minimum period necessary. The information outlined in this privacy notice will be kept in accordance with our retention schedule. Entries on the TAB register are kept for 3 years but can be removed earlier if circumstances change. All information will be held securely and destroyed under confidential conditions.

Entries will be reviewed regularly to ensure they remain accurate, relevant and necessary. Where the risk has reduced, the entry will be amended or removed. We will record the reason for adding, retaining, amending or removing an entry.

Your rights

You have rights under UK GDPR, including the right to:

• access your personal information
• ask us to correct incorrect or incomplete information
• ask for your information to be deleted (in certain circumstances)
• restrict how your information is used
• object to certain uses of your information
• request your information in a commonly used format (data portability)
• understand and challenge automated decisions and profiling.

We may not always be able to agree to a request if the law requires us to keep or use your information or we deem it as being captured as a legitimate interest for public safety.

If we restrict any right, we will explain why unless doing so would prejudice the purpose of the register or create a risk of harm. You may object to processing where we rely on legitimate interests or public task, and we will consider your objection in line with UK GDPR.

Complaints and further information

If you have questions or concerns about how your information is used, please contact the Data Protection Officer:

Email:        This email address is being protected from spambots. You need JavaScript enabled to view it. 
Phone:      01905 722233

Postal address:  

Data Protection Officer
Worcester City Council
The Guildhall
High Street
Worcester
WR1 2EY

If you remain dissatisfied, you have the right to complain to the Information Commissioner’s Office (ICO):

Website:   https://www.ico.org.uk 

Phone:      0303 123 1113

Postal address:   

Information Commissioner's Office,
Wycliffe House,
Water Lane,
Wilmslow,
Cheshire,
SK9 5AF

Changes to this notice

We may update this privacy notice from time to time. The latest version will always be available on our website.

Who we are

We are Worcester City Council.

We use personal information to provide services and meet our legal duties.

We are responsible for keeping your information safe.

What is personal information?

Personal information is information about you.

It can be information that:

• tells us who you are
• helps us contact you

For example:

• your name
• your address
• your phone number
• your email address

Some information is more private

Some information is very personal and needs extra care.

This can include information about your:

• health or disability
• race or ethnicity
• religion or beliefs
• sexual orientation
• political views
• trade union membership
• criminal history

We only use this information when the law allows us to.

Why we use your information

We use your information to:

• provide council services
• support you and assess your needs
• deal with questions or complaints
• manage our staff
• improve services
• plan for the future

When we are allowed to use your information

The law says we must have a good reason to use your information.

We may use your information if:

• you have given permission
• it is required by law
• it is needed to do our job as a council
• it is needed to keep someone safe
• it is needed for a contract or legal reason
• it is in the public interest

Giving or removing permission

If we ask for your permission, you can change your mind at any time.

To do this, contact: This email address is being protected from spambots. You need JavaScript enabled to view it.

We only use what we need

We only collect the information we really need.

If we do not need personal information:

• we will not ask for it, or
• we will make your information anonymous if possible

For research or planning, we usually remove names and details.

Who we share your information with

Sometimes we share information with other organisations.

This is only when:

• it is needed to deliver a service
• the law says we must
• there is a serious safety concern

We make sure:

• there is a legal agreement
• your information is protected

Keeping you and others safe

We may share information without asking you if:

• someone is at risk of harm
• a child needs protection
• a serious crime may occur

We only do this when the risk is high.

How we keep your information safe

We work hard to keep your information secure.

This includes:

• locking systems with passwords
• hiding information when possible
• only letting trained staff see your data
• training staff in data protection
• regular security checks

Where your information is stored

Most information is stored in the UK.

Sometimes it may be stored outside the UK.

If this happens, we make sure it is kept safe by law.

How long we keep your information

We only keep your information for as long as we need it.

Sometimes the law says we must keep it for longer.

This depends on the type of service.

Your rights

You have rights about your information.

You can:

• ask to see your information
• ask us to correct mistakes
• ask us to delete information (in some cases)
• ask us to limit how we use it
• object to some uses of your information

We may not always be able to agree if the law says we must keep it.

Computer decisions

Sometimes computers help us make decisions.

You can:

• ask how decisions are made
• ask for a decision to be checked by a person
• object to profiling in some cases

We will tell you if this affects you.

Cyber security

We take cyber security seriously.

We follow national security standards to protect your data.

Complaints

If you are unhappy with how we use your information, contact:

Data Protection Officer

Email:        This email address is being protected from spambots. You need JavaScript enabled to view it.
Phone:       01905 722233

Postal Address:
Data Protection Officer
Worcester City Council
The Guildhall
High Street
Worcester
WR1 2EY

You can also complain to:

Information Commissioner’s Office (ICO)

Website:     www.ico.org.uk
Phone:       0303 123 1113

Postal Address:
Information Commissioner's Office,
Wycliffe House,
Water Lane,
Wilmslow,
Cheshire,
SK9 5AF

Service being provided

Provision and coordination of support under UK Government resettlement schemes, including (but not limited to):

• Homes for Ukraine Scheme
• UK Resettlement Scheme
• Other Home Office‑funded resettlement and integration support programmes.

This includes welfare support, housing coordination, safeguarding, integration support, and administration of grant funding provided under government guidance for resettlement schemes and asylum seekers.

Categories of personal data we collect

Depending on the support required, we may collect:

• Name
• Address
• Contact details (email address and telephone number)
• Date of birth
• Gender
• Information about children or dependants
• Financial information (for administering grant payments or support)
• Identification documents (such as passport, eVisa, residence permit, or driving licence, where required)
• Unique identifiers (such as National Insurance number, where required).

Audio or video recordings will only be made where necessary and will be explained at the point of collection.

Special Category data we collect

We may process limited special category data where necessary to provide appropriate support, including:

• Disability or medical information (to support welfare, safeguarding, accessibility, or health needs)
• Racial or ethnic origin and nationality (where relevant to resettlement and Home Office requirements)
• Immigration status (where relevant to resettlement and Home Office requirements).

We may also process criminal offence data only where required, for example in relation to safeguarding or DBS checks.

Criminal offence data is processed in accordance with Article 10 UK GDPR and the Data Protection Act 2018, with appropriate safeguards in place.

We do not routinely collect data relating to sexual life, sexual orientation, trade union membership, or biometric data unless there is a clear legal requirement to do so.

Consequences of failing to provide personal data

If required personal data is not provided, this may delay or prevent the delivery of support, welfare assistance, accommodation arrangements, or grant funding under the relevant resettlement scheme.

Data Controller and Processors

For resettlement and support schemes, personal data may be processed by multiple organisations acting as independent Data Controllers in accordance with their statutory functions. These may include:

• Worcester City Council
• Worcestershire County Council
• The Home Office
• Ministry of Housing Communities and Local Government.

Each organisation is responsible for the personal data it processes. When data is shared externally, responsibility for that data passes to the receiving organisation and their privacy notice will apply.

The Data Protection Officer for Worcester City Council can be contacted at This email address is being protected from spambots. You need JavaScript enabled to view it.  

Purpose of Processing 

• Deliver government‑funded resettlement and integration support
• Co-ordinate housing, welfare, and community support
• Administer and pay grants under resettlement schemes
• Carry out safeguarding and welfare check
• Meet public‑health, health‑and‑safety, and safeguarding duties
• Manage funding, audit, and compliance requirements
• Prevent and investigate fraud or misuse of public funds

Lawful basis for processing personal data

• Article 6(1)(e) UK GDPR – Public task - Processing is necessary for the performance of tasks carried out in the public interest or in the exercise of official authority, including statutory resettlement and safeguarding duties; and
• Article 6(1)(c) UK GDPR – Legal obligation - Where processing is required under government directions, funding conditions, safeguarding law, or audit requirements.

This processing is carried out in line with Home Office and DLUHC guidance for resettlement schemes.

Lawful basis for processing special category and criminal offence data

 

• Article 9(2)(g) UK GDPR – substantial public interest, supported by Schedule 1, Part 2 of the Data Protection Act 2018, including safeguarding and protection of individuals at risk; and
• Article 10 UK GDPR, for criminal offence data, with appropriate safeguards.

Processing does not rely on consent for core resettlement activities.

Source of data

• You directly
• Parents or guardians (where the individual is a child)
• The home office (via approved systems)
• Ministry of Housing Communities and Local Government (via approved systems)
• Worcestershire County Council
• Voluntary organisations
• Other local authorities where a person moves between areas
• Health, housing, safeguarding, or support providers where lawful and necessary

Who we share the information with

We may share personal data where necessary and lawful with organisations involved in resettlement delivery, including:

• The Home Office (for case management, grant administration, and scheme monitoring)
• Ministry of Housing Communities and Local Government (via approved systems);
• Worcestershire County Council
• Other local authorities (if a person moves between council areas)
• Social and supported housing providers
• Health services (NHS and commissioned providers)
• Worcester City Welcomes Refugees (with consent)
• Department for Work and Pensions (DWP) where relevant to support or benefits

Information is shared only to deliver support, meet safeguarding duties, or comply with government requirements.

Details of data transfers to a country outside the UK and safeguards in place 

We do not routinely transfer data outside of the UK. Where personal data is transferred outside the UK, appropriate safeguards are in place, such as adequacy regulations or approved contractual clauses.

Automated decision-making

We do not carry out automated decision-making or profiling in relation to this processing.

How long we hold your information

In line with Government instructions, personal data relating to resettlement schemes will generally be retained for up to two years after closure of the relevant scheme, unless earlier deletion is instructed.

Support and advice service records will be kept for 2 years from their last interaction with us.

Information may be kept longer in line with safeguarding and legal requirements.

Information obtained via DBS checks is retained in accordance with guidance and deleted six months after receipt.

All information is held securely and disposed of confidentially.

Your rights

You have rights under UK GDPR, including the right to:

• access your personal information
• ask us to correct incorrect or incomplete information
• ask for your information to be deleted (in certain circumstances)
• restrict how your information is used
• object to certain uses of your information
• request your information in a commonly used format (data portability)
• understand and challenge automated decisions and profiling.

Some rights may be limited where processing is required for safeguarding, public‑interest functions, or legal obligations.

Individual’s right to withdraw consent at any time

Where your personal information is processed on the basis of consent (e.g. audio or video recordings), you have the right to withdraw this consent at any time.

Complaints and further information

If you have questions or concerns about how your information is used, please contact the Data Protection Officer:

Email:        This email address is being protected from spambots. You need JavaScript enabled to view it.
Phone:      01905 722233

Address:  Data Protection Officer, Worcester City Council, The Guildhall, High Street, Worcester WR1 2EY

If you remain dissatisfied, you have the right to complain to the Information Commissioner’s Office (ICO):

Website:   www.ico.org.uk

Phone:      0303 123 1113

Address:   Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

Changes to this notice

We may update this privacy notice from time to time. The latest version will always be available on our website.