We collect only the details we need to lend you a breast pump, support you with infant feeding, and get the pump back safely. We use this information to run the service, arrange deliveries and returns, and coordinate support with trusted partners (Family Hubs, hospitals and the Breastfeeding Network). We keep it securely, only for as long as we need, and you have rights over your data.
The personal data we collect
- Contact details – name, address, email and phone number
- Loan logistics – delivery and return locations, pump serial or reference number, accessories issued and returned, and signatures on the loan agreement
- Referral and support details – referrer’s name, department and contact details, and brief notes on infant-feeding support needed and outcomes
Why we use your data (purposes)
- Assess eligibility and set up the loan agreement, manage stock (pump IDs), deliveries and returns
- Provide infant-feeding support and follow-up, coordinating with Family Hubs and hospital partners and commissioned providers
- Audit, safeguarding and service improvement, including handling complaints and equipment safety and traceability
Our lawful bases
Public task (Article 6(1)(e) UK GDPR)
Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority. Local authorities have statutory duties around public health, early help, and family support services, which include infant feeding initiatives.
Contract (Article 6(1)(b) UK GDPR)
Processing is necessary for entering into and performing the loan agreement (for example, recording your details to issue and recover the pump).
When we collect or share special category personal data, we rely on the following lawful bases under UK GDPR:
Health or social care (Article 9(2)(h) UK GDPR)
We rely on the health or social care condition in the Data Protection Act 2018 to process your special category data.
Who we share your data with
- Family Hubs staff and Enfield Council teams
- Commissioned support providers: Breastfeeding Network (BFN)
- Hospital partners: Royal Free and North Middlesex University Hospital
- Senior management for oversight, audit or incident handling
How long we keep your data?
Personal data will be held on the register of LBE-owned breast pumps for up to 5 years from the date of return, after which time the borrower’s details will be securely destroyed.
How we protect your data
We use access controls, role-based permissions and secure storage on council systems. Partners are required to meet equivalent standards.
Your rights
You have the right to access your data, correct inaccuracies, and in certain cases object or request erasure or restriction. You also have the right to complain to the Information Commissioner’s Office (ICO). For further information about your rights, including circumstances in which they apply visit the Information Commissioner's Office.
Contact us
- Service contact: breastfeedingloansupport@enfield.gov.uk
- Data Protection Officer (DPO): enfield.data.protection.officer@enfield.gov.uk
- Make a subject access request: sar.enfieldcouncil@infreemation.co.uk
Changes to this notice
We may update this notice if our processing changes. The latest version will be available online or on request.
December 2025