STAFFORDSHIRE LOC
Privacy Notice
1. Who we are
Staffordshire LOC (“we”, “us”, “the LOC”) is the Local Optical Committee for the Staffordshire area. We are a statutory body representing local NHS General Ophthalmic Services (GOS) contractors and performers. We support engagement with NHS England, coordinate training, share sector updates, and carry out LOC governance functions. We are a Data Controller for the personal data we process; details for the Data Protection Lead (DPL) who coordinates compliance are as follows:
• Role: Michaela Kelcher Secretary
• Email: admin@staffsloc.co.uk
Note: the DPL is not a statutory Data Protection Officer (DPO).[A1.1]

2. About this Privacy Notice
This Privacy Notice explains:
• what personal data we collect
• why we collect it and how we use it
• the lawful bases we rely on
• how long we keep your information
• who we share data with
• international transfers
• your rights
• how to complain (including DUAA 2025 routes)
• the circumstances where we may transfer data to a new legal entity.

This Privacy Notice applies to:
Local GOS contractors and performers
LOC committee members and officers
training and event attendees
people who contact the LOC
website users
[A2.1]Note: the LOC does not process patient data.

3. The personal data we collect and how we use it
3.1 Summary table
Below is a table setting out:
• what we collect
• why we collect it (purpose)
• the lawful basis
• how long we keep it.
Data Category[A3.1] Purpose Lawful Basis (UK GDPR / DPA 2018 / PECR) Retention Period
Contractor/performer name and contact details Statutory functions; communications about pathways, governance, training Legitimate Interests; Public Task (where applicable) Until superseded or no longer required
Committee member contact details, declarations and role information LOC governance, meetings, elections, statutory records Legitimate Interests; Legal Obligation Term of office + 1 year
Event/training registrations and attendance Administering events and professional development Legitimate Interests; Consent (if optional comms) 2 years
Email addresses for optional newsletters Providing updates where consent is required Consent (PECR) Until consent withdrawn
Website analytics, cookies Website optimisation Legitimate Interests; Consent (for non-essential cookies) 12–24 months
Communications preferences Managing opt-outs and consent Legal Obligation; Consent Until superseded
Photographs from events Marketing and LOC communications Consent Until withdrawn or review every 3 years
Enquiry details submitted via email or contact form Responding to enquiries Legitimate Interests 1 year
Financial or administrative information relating to LOC operations Governance, reporting and accountability Legal Obligation 6 years
Stakeholder and partner contact details (NHS, LOCSU, suppliers) Partnership working Legitimate Interests As long as partnership is active

4. Where we obtain personal data from
We collect data:
• [directly from you (email, forms, event registrations, AGM attendance)
• from NHS England where contractor or performer lists are supplied
• from LOCSU (where required for governance support)
• through website analytics and cookies
• from publicly available professional contact information.]
Note: the LOC does not collect data from children or process sensitive health information.

5. How we use your information
We use your personal data to:
• [carry out our statutory role as the Local Optical Committee
• communicate with local contractors and performers
• provide updates on NHS pathways, training and local service development
• organise meetings, training and events
• carry out governance (elections, AGMs, minutes)
• manage stakeholder relationships
• administer finances, commissioning engagement and LOC operations
• respond to enquiries,
• maintain our website, digital systems and mailing lists.][A4.1]

6. Lawful bases we rely on
Depending on the activity, we rely one, or more, of the following bases as outlined in 6.1 to 6.3.

[6.1 Legitimate Interests[A5.1]
For most LOC activities including:
• communications with contractors/performers
• managing governance and committee activities
• running meetings, training, engagement and stakeholder work.
We ensure these interests are balanced against your rights.

6.2 Public Task / Legal Obligation
For statutory functions such as:
• AGM notices
• elections
• levy management
• reporting required by NHS England.

6.3 Consent
Used only where required by PECR or ICO guidance, e.g.:
• optional newsletters to non-contractors
• use of photographs
• certain event marketing
• non-essential cookies.
Where we require your consent, and you give us consent, you may withdraw consent at any time. [For example, if you consent to us sending you newsletter, you can unsubscribe by clicking the link in the email. If you have consented to us processing your data for another purpose, you can withdraw consent by contacting us at admin@staffsloc

7. Marketing communications and consent management
We may send information on:
• [essential operational updates
• NHS pathways
• training and local events
• sector updates relevant to contractors and performers.
This information falls under Legitimate Interests or Public Task.

If the LOC publishes optional newsletters or wider communications, we will gain consent as required by PECR, which is:
• specific
• informed
• freely given
• recoded and auditable
• easy to withdraw at any time (each communication will include an unsubscribe link).

8. Who we share your information with
We may share data with:[A6.1]
• [the Local Optical Committee Support Unit (LOCSU)
• NHS England or ICS/ICB teams
• training providers
• accountants, auditors and administrative service providers
• IT and website service providers
• professional bodies (e.g. ABDO, FODO, AOP) where appropriate.]
In certain circumstances we will be required to disclose personal data. Examples include:
• In an emergency situation (e.g. life or death) – i.e. to protect the vital interest of an individual(s).
• In the interest of national security.
• To prevent or detect crime, including the apprehension or prosecution of offenders.
• To prevent serious harm to an individual(s) – e.g. a health and safety concern.
[Note: We do not sell data or allow third parties to use it for their own marketing.]
All partners and/or parties we disclose information to must keep your information secure and follow UK GDPR requirements.

9. International transfers
Some cloud services may store data outside the UK. Where this happens, the LOC ensures:
• a UK adequacy decision applies, or
• Standard Contractual Clauses / IDTA Addendum are in place, or
• a Transfer Risk Assessment has been completed.
Note: we will not transfer data internationally unless appropriate safeguards exist.

10. How we keep your data secure
We have appropriate physical and technical security measures in place to protect your personal data. We ensure that we have provisions in place to ensure that only authorised people have access to personal data, that your data is kept secure, and that we have processes and procedures in place to prevent accidental loss, destruction, alteration, unauthorised access or disclosure of your personal data.
We have incident and breach processes and procedures in place to deal with and respond to any suspected breaches of your personal data and will notify you and any relevant regulators in the event of a breach where we are required to do so. Measures we have in place include:
10.1 Technical measures[A7.1]
The LOC uses appropriate measures such as:
• [password-protected devices
• encrypted storage
• secure cloud-based systems (e.g. Microsoft 365)
• limited access controls
• secure email where appropriate.]

10.2 Organisational measures
• [confidentiality agreement for all committee members
• clear desk and secure storage practices
• use of LOC email accounts for LOC business
• regular review of access permissions
• archiving and deletion in line with retention schedule.]

11. Rights of individuals (Data Subject Rights)
Under UK GDPR and the Data Protection Act 2018 you have the right to:
• access your data (Subject Access Request)
• rectify inaccurate information
• erase your information (in certain circumstances)
• restrict processing
• object to processing
• withdraw consent (where consent is used)
• data portability (where applicable)
• be informed about how your data is used (this notice).
You can exercise your rights by making a request to us by post, email, telephone, in-person, or online.

12. Automated decision making and profiling
We do not use automated decision-making or profiling.

13. Cookies
A cookie is a small file which asks permission to be placed on your computer’s hard drive. Once you agree, the file is added and the cookie helps analyse web traffic or lets you know when you visit a particular site. Cookies allow web applications to respond to you as an individual. The web application can tailor its operations to your needs, likes and dislikes by gathering and remembering information about your preferences.
Our website uses cookies as set out below
Cookie Category[A8.1] Purpose Lawful Basis (UK GDPR / DPA 2018 / PECR)
Essential Website functionality Legitimate Interest
Non-essential Analytics/ Marketing Consent

Specific cookies used:
• [Google Analytics
• Cookie consent plugin
• Logged in users]
Where we use tracking, we will ask you to consent to our use of cookies when you first visit our website. As a rule, cookies will make your browsing experience better. However, you may prefer to disable cookies on this site and on others. The most effective way to do this is to disable cookies in your browser and we suggest consulting the Help section of your browser.

14. Transfer of data to another legal entity
If the LOC is subject to a restructure, merger, or transfer of functions:
• personal data may be transferred to a new lawful successor organisation
• you will be notified in advance where possible
• the recipient must comply with all UK data-protection laws
• the purposes of processing will remain aligned with statutory LOC functions.
15. Your right to complain (UK GDPR and DUAA 2025)
You can raise concerns or complaints in the following ways:

15.1 To the LOC (first step)
Email: [Insert]

15.2 To the ICO (UK’s supervisory authority)
Website: www.ico.org.uk.

15.3 Under the DUAA 2025
You have a statutory right to complain about:
• poor data handling
• failure to meet data-subject rights
• misuse or incorrect access to your data
• poor fairness, accuracy, or transparency in data use.
Regulators must investigate complaints unless they are frivolous or vexatious. You can raise a DUAA complaint:
• through the LOC
• through the ICO (who must consider the DUAA requirements).

16. Changes to this Privacy Notice
We may update this notice periodically. The latest version will always be available on our website. Where changes are material, we will notify you.

 
APPENDIX 1: Cookie Notice

Purpose
This notice is hosted on the LOC website and provided as a link within the cookie pop-up when a visitor first accesses the website.

Cookie Notice
This site uses cookies – small text files that are placed on your machine to help the site provide a better user experience. In general, cookies are used to retain user preferences, store information for things like shopping baskets, and provide anonymised tracking data to third party applications like Google Analytics.
As a rule, cookies will make your browsing experience better. However, you may prefer to disable cookies on this site and on others. The most effective way to do this is to disable cookies in your browser and we suggest consulting the Help section of your browser.
For more information see our privacy policy on LOC website.