Guidance

DHSC email subscription privacy notice

Published 29 September 2023

Applies to England

Summary

This privacy policy sets out how and why we, Department of Health and Social Care (DHSC), use and protect your personal information when you sign up to receive e-communications from us.

DHSC is using an e-marketing platform to communicate directly with a range of external, parliamentary and internal contacts allowing us to reach the right people at the right time.

Data controller

DHSC will be the controller of your personal information. This means that we are responsible for deciding how your personal information is used and ensuring that it is used in compliance with applicable data protection law (in conjunction with other parties, where applicable).

What personal data we collect

We collect the following information on DHSC communications:

• name
• email address
• organisation
• job title
• job role
• IP address

How we use your data (purposes)

DHSC uses a third-party e-communication platform called e-shot (hosted by a company called Forfront) which allows us to deliver customised, accessible, interactive e-marketing.  

Having an e-marketing system allows the following benefits:     

• we can communicate directly with a range of stakeholders and allows us to reach the right people at the right time
• we can send bulk emails in a compliant way with higher rates of deliverability (unsubscribe links, trusted domain)
• we can send timely, on-brand communications
• ensures e-communications are fully accessible
• produces cost-effective (relatively inexpensive) digital campaigns
• we have a forum for internal organisational self-promotion
• we own our content, media and contact lists
• provides a mechanism to analyse and review the impact of e-marketing
• allows us to collect feedback and surveys

The DHSC Digital Content team are responsible for the day to day use of e-communications but each DHSC team using the platform is responsible for their own data and personal data held on the e-marketing platform.

Email tracking

When you receive an email from us, we may receive certain information about how you interact with that email.

The information we collect includes:

• the number of times you have opened the email
• if you have clicked links in the email
• whether you have unsubscribed or marked the email as spam
• whether the email has bounced
• whether you have shared the information on social media, or forwarded it to friends

We use this information to:

• assess how successful our email campaigns are
• identify what you are interested in and target further marketing campaigns more accurately
• reduce the frequency with which we contact you if appropriate
• remove you from our mailing lists where you have asked to unsubscribe

We use an email service provider called ‘e-shot’ to do this.

Legal basis for processing personal data

Under the General Data Protection Regulation (GDPR), the lawful basis we rely on for processing this information is we need it to perform a public task.

Data processors and other recipients of personal data

We use an email service provider called ‘e-shot’ managed by Forfront to deliver customised, accessible, interactive e-marketing as well as analyse how you engage with our e-marketing.

Forfront complies with all applicable data protection regulations and they act as a Data Processor on behalf of DHSC (the data controller) using the e-shot platform. 

International data transfers and storage locations

Our email service provider ‘e-shot’ managed by Forfront store their data in UK based servers.

Retention and disposal policy

We plan to retain data for 2 years and we will delete your data if you have unsubscribed from our e-communications.

How we keep your data secure

We will store your data using secure hosting (compliant with the National Cyber Security Centre (NCSC) cloud security principles and ICO guidance). Our e-marketing system restricts access to different data sets, so your data will only be seen by people that need to contact you. 

e-shot uses physical, technical, and procedural safeguards that comply with the applicable legal standards to secure your information from unauthorised access and use, alteration and destruction. e-shot limits access to only those employees who have authorisation and require access to perform their roles and have our security measures and practices routinely audited by external certified assessors. See more detail on the e-shot website.

We will never sell your personal information.

Your rights as a data subject

By law, data subjects have a number of rights and this processing does not take away or reduce these rights under the EU General Data Protection Regulation (2016/679) and the UK Data Protection Act 2018 applies.

These rights are:

1. The right to get copies of information - individuals have the right to ask for a copy of any information about them that is used.

2. The right to get information corrected - individuals have the right to ask for any information held about them that they think is inaccurate, to be corrected.

3. The right to limit how the information is used - individuals have the right to ask for any of the information held about them to be restricted, for example, if they think inaccurate information is being used.

4. The right to object to the information being used - individuals can ask for any information held about them to not be used. However, this is not an absolute right, and continued use of the information may be necessary, with individuals being advised if this is the case.

5. The right to get information deleted - this is not an absolute right, and continued use of the information may be necessary, with individuals being advised if this is the case.

Comments or complaints

Anyone unhappy or wishing to complain about how personal data is used as part of this programme, should contact data_protection@dhsc.gov.uk in the first instance or write to:

Data Protection Officer
39 Victoria Street
London
SW1H 0EU

Anyone who is still not satisfied can complain to the Information Commissioners Office. Their website address is www.ico.org.uk and their postal address is:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Automated decision making or profiling

No decision will be made about individuals solely based on automated decision making (where a decision is taken about them using an electronic system without human involvement) which has a significant impact on them.

Changes to this policy

This privacy notice is kept under regular review, and new versions will be available on our privacy notice page on our website. This privacy notice was last updated on 29 September 2023.