Mayor of London logo London Assembly logo
Home
Police on duty

MOPAC Privacy Notice

This privacy notice tells you what to expect when the Mayor’s Office for Policing and Crime (MOPAC) processes your personal information. This notice also covers the processing undertaken by the Violence Reduction Unit (VRU).

We are committed to keeping your information safe and secure.

If you have any questions regarding this privacy notice or how your data is processed, please contact the DPO at: [email protected].

See more information on data protection at MOPAC and your privacy rights.

How we collect data about you

We may collect data about you from several different sources including;

  • Directly from you, i.e. when you contact us including to make a complaint, to submit a Freedom of Information Request, to submit a question for the Mayor, to sign up to receive our newsletter, to apply to work or volunteer with us or if you take part in an event, survey, online discussion, forum or research project.
  • Via our website i.e. when you complete a web form
  • Via any telephone, written and email enquiries you may make
  • From third parties including providers of our commissioned services, the MPS and the NHS (you will always be informed if your data will be shared with us and if so for which purpose(s).

The information we process

Depending on your circumstances, the service(s) you use and the purposes for the processing, we

may process data about you or your circumstances. You will always be informed how your data will be processed at the point your data is collected. This data we may process includes:

  • Your name
  • Your contact details / email address
  • Your date of birth
  • Identification numbers, i.e. custody reference numbers
  • Other information about you including special category data such as your ethnicity.
  • Information about members of your family
  • Details of a crime you may have witnessed or been a victim of
  • Details of a crime you may have committed or have been alleged to have committed
  • Details of your outcomes processed for evaluation purposes where you participate in a programme with a third party commissioned by MOPAC (including the VRU). This information may be linked across services / instances of use where you use more than one service or use a particular service more than once
  • Applicant details if you apply for a position with us
  • Your details when you volunteer with us
  • Images or recordings (including video and/or audio) may be captured including if you attend a research session, event or online webinar (you will be informed if this is the case prior to the us processing this data and informed of actions available to you should you not wish to be captured).
  • Survey / feedback responses (where personal data is collected)
  • Details of any contact you make with us, i.e. any enquiry, request or complaint you may send to us. MOPAC have a detailed complaints policy which sets out how we deal with any complaints we may receive.

The purposes of our processing

We may process your data for various purposes including:

  • To communicate with you, including sending you our newsletter (where you have signed up to receive this).
  • To respond to you where you contact us including to respond to a request, query or complaint you have made. This includes where you contact the Victims Commissioner or Deputy Mayor for Policing of Crime and covers all formats of communication (i.e. letter, email, telephone or via social media etc). Where necessary we may need to share your personal information with third parties so that we can properly investigate your enquiry / complaint. This could include the MPS where sharing is necessary for us to carry out a review, or the Independent Office for Police Conduct (IPOC) if we are required by law to refer your complaint to them.
  • To invite you to participate in a survey or to analyse your responses (where you have provided your personal data). Where you have agreed we may also contact you at a later date to ask you to participate in further research.
  • To invite you to attend an event (in person or online) and to contact you after the event for feedback or for further engagement purposes.
  • We process demographic data including special category data (such as ethnic origin) from survey respondents to ensure our research samples are representative of the London population. We may also process this data relating to users of our commissioned services in order to evaluate the effectiveness of these services and to ensure our services are reaching all diversity groups of Londoners.
  • For evaluation purposes or for research purposes. This includes where you contribute to consultations, surveys, in-person forums, or where we receive data from providers we commission to provide various services. Where necessary we may link data from more than one source to enable us to carry out more informed research and evaluation work or we may share your data with third parties for the purposes of completing our evaluation or research work.  We will never share personal data externally in our reports. Details of how your data will be processed will be made available at the point your data is collected for the purposes of a particular project or service.
  • To process an application you have made to volunteer with us (and if you are successful to manage your volunteering journey as detailed on our employee privacy notice).
  • To process an application you have made to work for us (including secondments), to assess your suitability for the role you have applied for, to shortlist you (if applicable), to invite you for assessments/interviews, to carry out pre-employment checks and to notify you of the outcome (and if you are successful to manage your employment as detailed on our employee privacy notice). When you apply to work for us, provision of information related to your protected characteristics is optional but where it is provided it will be processed for equal opportunity purposes.
  • To showcase our work (i.e. by sharing videos or photos or audio). We may share these recordings/images internally or externally. We will ensure that we have a lawful basis for any sharing and that you are informed if your images/recordings will be shared in this way (and given the opportunity to decline).
  • When you visit our website we collect standard internet log information and details of visitor behaviours to determine information such as numbers of visitors and areas of the website visited. We use Google Analytics for this processing but you will not be identifiable from this data.
  • Sometimes where you have contacted us and we believe you or another individual may be at risk we may share your details with third parties (i.e. the MPS or social services) to ensure that the person(s) at risk are protected from harm.
  • Where you work for an organisation who work with us or are commissioned by us, i.e. a service provider or where you apply for or receive funding we may process your work related data in order to interact with you.
  • MOPAC’s Directorate of Audit, Risk and Assurance (DARA) may process data to fulfil its obligations under the National Fraud Initiative and for auditing purposes.

The lawfulness of our processing

The lawful bases we rely on for processing your personal data

  • UK GDPR Article 6(1)(e) Public Task - MOPAC is a public authority, so in most cases, the lawful basis we rely on for processing your personal data will be UK GDPR Article 6(1)(e) Public Task. This includes where we are carrying out our statutory functions.
  • UK GDPR Article 6(1)(a) Consent - We sometimes rely on the lawful basis of Consent (UK GDPR Article 6(1)(a)) as our lawful basis to process your data, i.e. where we may ask you to consent to our processing of images or video / audio recordings of you, or we may rely on consent where you agree to hear from us for research purposes. Where we rely on the lawful basis of consent you have the right to change your mind and withdraw your consent at any time. Please note that were we may be processing your data under the lawful basis of consent (in particular photos/videos for public awareness purposes) and have shared these externally, i.e. on our website or in printed materials, it would be unlikely we would be able to delete all copies should later withdraw your consent to this processing.
  • UK GDPR Article 6(1)(c) Legal Obligation - We may also process data where we have a legal obligation to do so, (UK GDPR Article 6(1)(c)) i.e. for the information we process to carry out police compliant reviews in our role as the Relevant Review Body, or where we process your data to respond to an FOI or individual rights request under the UK GDPR.
  • UK GDPR Article 6(1)(b) Contract - We may rely on the lawful basis of Contract to process your data, for example where you are employed by us and we have a contract of employment with you (see our Employee Privacy Notice).
  • UK GDPR Article 6(1)(f) Legitimate Interests - As a public authority we are unable to use the lawful basis of legitimate interests (UK GDPR Article 6(1)(f)) in the exercise of our official functions but we may use this for other limited processing purposes. This may include where we process group images where our legitimate interest is to showcase our work or to share content of webinars with all interested and relevant parties who may have been unable to attend the live session. We may also rely on this lawful basis for processing where you apply to work for us, but as we process your application further we may later rely on the lawful basis of Contract (Article 6(1)(b) where we process your data in order to enter into a contract with you.

The lawful bases we rely on for processing your special category data

  • UK GDPR Article 9(2)(g) Substantial Public Interests - Where we process your special category data we also ensure we have a further lawful basis for this processing. This is likely to be UK GDPR Article 9(2)(g) Substantial Public Interests where the processing is in the public interest and where we also have a basis in UK law.  We will also ensure we have an appropriate condition from the Data Protection Act 2018 to enable this processing. If we feel we need to share your data in order to protect you or another individual from harm we will rely on the UK GDPR lawful basis of Substantial Public Interest and will ensure we have a condition from the Data Protection Act 2018 such as the processing is necessary for the purposes of safeguarding children or individuals at risk.
  • UK GDPR Article 9(2)(a) Explicit Consent - If we are relying on your consent to process special category data we will ensure we have collected your valid explicit consent (UK GDPR Article 9(2)(a)).  You will have the right to withdraw your consent at any time.
  • UK GDPR Article 9(2)(h) purposes related to preventive or occupational medicine -Where you apply to work for us and we process your special category data we may rely on the lawful basis of UK GDPR Article 9(2)(h) where the processing is necessary to assess your working capacity or needs for support.
  • UK GDPR Article 9(2)(j) Research Purposes - We also carry out research in order to assess the effectiveness and equality of reach of our service provisions. We collect data from external sources including the MPS and service providers. Where necessary we may link data from more than one source to enable us to carry out more informed research and evaluation work.  We may rely on the lawful basis of UK GDPR Article 9(2)(j) where the processing is necessary for research purposes. Details of how your data will be processed will be made available at the point your data is collected for the purposes of a particular project or service.
  • Criminal Offence Data - Where we process data related to criminal offences we ensure we have a condition from the Data Protection Act 2018 for this processing.

You can read more about what all of this means on the Information Commissioner’s Office website.

Retention

We do not retain your personal data for longer than necessary. We retain your data in compliance with legal requirements where applicable, or only for as long as there is a specific purpose to do so.  Data is securely deleted when it is no longer required, or in some circumstances your data will be anonymised so it can no longer be used to identify you. Retention periods are detailed in our retention schedule and you will be informed of the specific retention period of your data when it is collected, but some relevant retention periods are also detailed below. Further details are available on request.

Some key retention periods:

  • Communications including emails and complaints – 8 years
  • FOI / Individual rights requests – 2 years
  • Photos / videos (and where relevant a copy of your consent form) - maximum of 4 years
  • Applicant details – where you are not successful we will retain your data for 6 months unless you meet our merit list criteria where we will retain your data for 12 months and may contact you should a suitable position become available. If you are successful your data will be retained as detailed in our employee privacy notice.

Who will we share personal data with?

We will not disclose any of your personal information to any third parties unless it is necessary to do so and we have a lawful basis for the sharing. Where we share your personal data, we will ensure we have in place appropriate agreements with any third parties to protect your data. You will be informed of any processing where your data is collected for a specific purpose. If you wish to know more you should read the relevant third party’s privacy notice or may contact us for further details.

In limited and necessary circumstances, your personal information may be transferred outside of the UK. Where such transfers occur, we will ensure that adequate safeguards are in place to protect your data either through appropriate contractual arrangements or another appropriate international transfer mechanism as required by law.

Where you contribute to our research we may use third parties including Opinion Research Services to conduct online surveys and interviews. Opinion Research Services conduct the User Satisfaction Survey (USS), Telephone and Digital Investigation Unit (TDIU) Survey and Public Attitude Survey (PAS) for us. 

MOPAC do not usually receive personally identifiable information about participants who take part in these research activities, we would instead receive anonymised information to allow us to understand the feedback received.  However, in the case of the USS and TDIU, personal information is used by MOPAC to identify potential interviewees from a cohort derived from police recorded information. MOPAC ensure this data is transferred to the provider securely and any information retained by us is securely stored for a maximum of three years.

In some circumstances we share data we have received from service providers with third parties for evaluation purposes, but sometimes data is sent directly from the service provider to the evaluation provider under our instruction. This processing is undertaken in order to help us understand the impact the services we commission is having on Londoners. We ensure we have appropriate processing agreements and measures in place to protect this data.

Should you wish for us to communicate with you in a language other than English we will need to share data with an external translation service provider. We will ensure your information is protected and processed securely and in compliance with data protection legislation.

We use Adobe’s Creative Cloud to securely process our video content. Adobe process this data outside of the UK, including in the US and relies on the UK Addendum to the EU Standard Contractual Clauses to ensure this processing is lawful.

We use Mailchimp, to manage our newsletters and where you have signed up to receive these we will share your email address in order for these to be sent to you. We gather statistics around number of emails opened and clicks within email content to help us monitor and improve our newsletters. You can unsubscribe at any time but where you unsubscribe we will retain your details on an ‘opted-out’ list to ensure we do not contact you again in the future. Mailchimp process this data in the US and relies on the UK Addendum to the EU Standard Contractual Clauses to ensure this processing is lawful.

We use a Sprout to manage our social media interactions. If you send us a private or direct message via social media the message will be stored by Sprout for three months and then deleted. Sprout process this data in the US and relies on the UK Addendum to the EU Standard Contractual Clauses to ensure this processing is lawful.

Where you apply to work for us using our applicant tracking system, your data will be processed by MHR on the People First system. Your data will be processed in the UK. If you are successful and we make a conditional offer you will be asked to complete an Occupational Health questionnaire and this information will be shared with Optima Health who will help us determine if you are fit to undertake the work you have been offered and advise us if any workplace adjustments are required. You are able to request to see this report before it is sent to us and can decline to allow it be shared, although this may affect your employment officer.

You will also be required to have security clearance prior to starting work for us and may be required to complete a third party security vetting form which is processed by the Metropolitan Police Service, or a DBS form (processed by a third party). MOPAC will be informed only of the result of your vetting / DBS check and this will also be shared with you.

We use Microsoft systems to process our work and this means that your data could be processed by Microsoft. Where this is the case your data will not be processed outside of the European Union and we rely on the adequacy decision for this transfer.

We may also receive data from third parties, including:

When organising events (including webinars), MOPAC may ask you to register for the event via Eventbrite. Where you register for the event via Eventbrite, MOPAC will access your information for the purposes of organising the event and understanding who will be attending. Eventbrite will process your data in the US and relies on the UK Addendum to the EU Standard Contractual Clauses to ensure this processing is lawful. You should refer to their privacy notice for further information.

MOPAC works with Talk London to facilitate some of our consultations but do not receive your data directly from them.

Third party recruiters where we advertise vacancies, or where you are employed as a temporary member of staff will share your data with us. 

Data subject rights

You have a number of rights which may be applicable in relation to your data depending on the circumstances of the processing.

These rights are:

  • The right to be informed
  • The right of access
  • The right of rectification
  • The right to erasure
  • The right to restrict processing
  • The right to data portability
  • The right to object

Where we are processing your data under the lawful basis of consent, you have the right to withdraw your consent.

We do not carry out any automated decision making or profiling.

To exercise any of your rights, please contact the DPO: [email protected]

You also have the right to complain to the ICO if you are unhappy with the way we process your data. Details of how to contact the ICO can be found here: Make a complaint | ICO

You can also find more information on the ICO website.

This privacy notice is updated from time to time and we recommend you revisit this notice to check for updates.

For further details about how your personal information is used, how we maintain the security of your personal information or to exercise any of your rights including to access the personal data we hold about you please contact: [email protected].

Cookies

A cookie is a piece of text that a website transfers to your computer's hard disk so that it can remember who you are. They make interaction between your computer and our website faster and easier by remembering any registration details and preferences from previous visits.

A cookie will typically contain the name of the website from which the cookie has come, the lifetime of the cookie and a value. It does not give us access to the rest of your computer and only the site that created the cookie can read it.

There are different types of cookies:

Session cookies: to ensure you are recognised when you move from page to page within our site and that any information you enter is remembered.

Persistent cookies: to recognise you as a unique visitor to our website so that we can tailor content to match your interests.

You can learn more about the cookies used on this website here:
Website privacy statement | London City Hall

You can control the cookies this website places on your device by following the ‘view cookies settings’ link at the bottom of this page, or through your web browser. To manage cookies through your browser click on your browser settings to find out the options your chosen browser allows.

If you’d like to learn more about cookies, including how they have been set and how to manage them, see more about cookies.

Need a document on this page in an accessible format?

If you use assistive technology (such as a screen reader) and need a version of a PDF or other document on this page in a more accessible format, please get in touch via our online form and tell us which format you need.

It will also help us if you tell us which assistive technology you use. We’ll consider your request and get back to you in 5 working days.