The lawful purpose for processing your data:
In response to the Covid 19 crisis North Devon Council is working with the central government Department for Environment, Food and Rural Affairs (DEFRA), Tesco and Iceland to offer priority supermarket delivery slots which we can offer to vulnerable or shielded individuals who have the ability to pay but are struggling to access food due to a change in circumstances.

The lawful basis we rely on is as follows:
Processing is necessary for the purposes of the legitimate interests pursued by the data controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal Data (GDPR Article 6(1)(f)). In this respect it is in the Council’s, DEFRA’s and Tesco’s legitimate interests to process this data in accordance with the project specified in this Agreement. The expectations of privacy of the data subject does not outweigh this legitimate interest substantially on the basis that this service is only provided in response to an informed request for the service by the data subject.

What we need
We will only process your personal data for the above lawful purpose where you contact us and request to be receive this service and following our triage process.  We will take your name, address, telephone number and email address.

What we do with it
We will collect and process your data by uploading it to a secure portal managed by DEFRA.

DEFRA will then process your data (along with others requesting the service) to generate a secure and encrypted list which is downloaded from the secure portal by Tesco plc.  Tesco plc will then process this data on their systems and generate a database with matching data recorded for each individual requesting a delivery slot. The resulting encrypted and password protected database is uploaded by Tesco plc to DEFRA’s secure file store.

The shared data will in turn be shared by DEFRA with Tesco plc by allowing Tesco plc to download information from DEFRA’s system via a secure access mechanism.

The data will be transferred on a daily basis by DEFRA to Tesco plc to be matched against their customer database. As a result of this matching Tesco plc will take one of the following actions with your data:

• If you are matched as an existing customer on the Tesco plc customer database then you will be offered one of the reserved delivery slots by Tesco plc unless you cannot be offered a delivery slot because of logistical constraints (such as where Tesco has no stores or delivery capability in your locality)
• It you are not matched as an existing customer you will be offered the opportunity to become a customer of Tesco plc which you will need to do to secure a delivery slot.  However, as above you may not be offered the opportunity to become a customer and secure a delivery slot if there are logistical constraints (such as where Tesco has no stores or delivery capability in your locality)

Where you are not an existing customer of Tesco plc, Tesco plc may use the personal data we collected from you and provided to DEFRA to communicate with you to offer you the opportunity to become an online customer for the sole purpose of offering you one of the delivery slots.

Tesco plc will send no more than four (one service message is anticipated) such communications within a period of 30 days, beginning from the day after receipt of your data from DEFRA. If you do not respond within this period, then your name and all associated personal details provided by DEFRA shall be deleted and a suitable record of this action sent back to DEFRA and confirmation that this deletion has taken place.

Where you request a priority delivery slot with Iceland, you will be provided with a code for you to register as a customer and use on Iceland's website.  The Council will not share your personal data with Iceland or process your personal data further.

How long we keep it
We will hold your data for 18 weeks from the date when you make a request for this service unless you ask us to remove your name as you no longer wish to receive the delivery slots offered by Tesco.

What are your rights?
We are acting pursuant to the legitimate interests of us (the Council), DEFRA and Tesco. You therefore have the right to object to our processing of your personal data. There are legitimate reasons why we may refuse your objection, which depend on why we are processing it. For more information on your rights see Your Rights.