City of York Council (CYC) current data protection notification is registered with the Information Commissioner’s Office (ICO) – reference Z5809563. We regularly review this privacy notice and it was last updated in February 2023.
CYC is the controller for this information unless we specifically state otherwise in this privacy notice.
When we use your personal data, York Mansion House complies with data protection and privacy legislation.
To make it clear how we collect and use your personal data, and to help you understand your rights, we've divided our Privacy Notice into the following areas:
- personal data
- collecting personal data
- using your personal data
- retaining personal data
- transferring personal data abroad
- further processing of personal data
- your rights relating to personal data
If you have questions about this privacy notice, want to exercise any of your legal rights, or you have a complaint about how your personal data has been used, email: [email protected], telephone: 01904 554145 or write to:Corporate Governance Team, West Offices, Station Rise, York, YO1 6GA.
'Personal data' is any information that relates to an identifiable living person; whether they are identified directly or indirectly by reference to a name, identification number, location data, an online identifier or to one or more factors specific to their physical, physiological, genetic, mental, economic, cultural or social identity.
For the purposes of data protection legislation the term 'personal data' also includes:
- personal information that has been pseudonymised or key-coded (depending on how difficult it is to attribute the pseudonym to an individual)
- genetic data and biometric data where processed to uniquely identify an individual ('sensitive personal data' or 'special categories of personal data')
Personal data doesn't include information relating to deceased people, groups or communities of people, organisations or businesses, nor to data relating to criminal convictions and offences.
However, similar safeguards apply to data processing in those fields.
Find out about the non-personal data we hold and process.
Collecting personal data
When the Mansion House collects your personal data we will ensure;
- you know why we need the information and when you have a choice about giving us your personal data
- we'll only ask for what is necessary to provide the service to you
- we'll use the data to assist in providing the information you're requesting
- we'll protect your data and make sure nobody has access to it who should not
- we'll keep your data secure and ensure that the privacy of individuals is protected
- we'll make sure we don’t keep it for longer than is necessary
In some cases you may only need to provide your name and address, in other instances we'll need more details or may require personal data or special categories of personal data. For example, if you have any access requirements.
Using personal data
We will use your information to provide the Mansion House services such as:
- Guided tours
- When you book or pay for a Mansion House Events
- Hiring the Mansion House
- Customer surveys
We use TYGtickets to book and /or pay for a Mansion House Guided Tour or Event.
The names and contact details of the attendees will be used to ensure the correct visitor is on the tour Your booking details will be stored by TYGtickets for 12 months after the purchase date and we will be able to access your details on that system.
We operate CCTV at the Mansion House and you can find more details about this at CCTV Privacy Notice.
We may be required or permitted, under data protection legislation, to disclose your personal data without your explicit consent. For example, if we have a legal obligation to do so, such as law enforcement, regulation and licensing, criminal prosecutions and court proceedings.
We must protect public funds and may use personal data and data-matching techniques to detect and prevent fraud, collect taxes and ensure public money is targeted and spent in the most appropriate and cost-effective way. To do this, your personal data may be shared with other bodies responsible for auditing or administering public funds, including the Department for Work and Pensions, HM Revenue and Customs, the Police and other local authorities.
We may monitor and record electronic communications (website, email and phone conversations) for a number of reasons, for example, records of conversations or detection, investigation and prevention of crime. We'll inform you if your call is being recorded or monitored.
Consultation and survey privacy notices
If we ask you to take part in consultation for example, a survey, we will notify you as part of the consultation or survey and we will publish the associated privacy notice on York Open Data.
Retaining personal data
We will only keep your information for as long as is necessary and then we will delete or destroy it securely.
At the end of the retention period, we may pass any relevant information to the City Archives where it is required or appropriate to do so.
Transferring personal data abroad
We don’t routinely transfer personal data outside of the UK but when this is necessary we ensure that we have appropriate safeguards in place and that is done in accordance with the UK data protection and privacy legislation.
Further processing of personal data
Before we use personal data for a new purpose (not covered by this privacy notice or any of our service privacy notices), we'll provide a new notice to set out the relevant purposes and processing conditions. Where and whenever necessary, we'll seek your prior consent to new processing.
Your rights relating to personal data
When we collect your personal data we'll tell you how we are going to use it. Where we process your personal data, you have a number of rights under data protection law.