Cookie Consent by

Mansion House Privacy Notice

City of York Council (CYC) current data protection notification is registered with the Information Commissioner’s Office (ICO) – reference Z5809563. We regularly review this privacy notice and it was last updated in September 2022.

CYC is the controller for this information unless we specifically state otherwise in this privacy notice

When we use your personal data, York Mansion House complies with data protection and privacy legislation

To make it clear how we collect and use your personal data, and to help you understand your rights, we've divided our Privacy Notice into the following areas:

If you have questions about this privacy notice, want to exercise any of your legal rights, or you have a complaint about how your personal data has been used, email: [email protected], telephone: 01904 554145 or write to:

Corporate Governance Team
West Offices
Station Rise

Personal data

'Personal data' is any information that relates to an identifiable living person; whether they are identified directly or indirectly by reference to a name, identification number, location data, an online identifier or to one or more factors specific to their physical, physiological, genetic, mental, economic, cultural or social identity.

For the purposes of data protection legislation the term 'personal data' also includes:

  • personal information that has been pseudonymised or key-coded (depending on how difficult it is to attribute the pseudonym to an individual)
  • genetic data and biometric data where processed to uniquely identify an individual ('sensitive personal data' or 'special categories of personal data')

Non-personal data

Personal data doesn't include information relating to deceased people, groups or communities of people, organisations or businesses, nor to data relating to criminal convictions and offences.

However, similar safeguards apply to data processing in those fields.

Find out about the non-personal data we hold and process.

Top of page

Collecting personal data

We will only ask you for the information that is necessary to provide you with the service you are contacting us about and to provide the best possible service to you.

The areas where we may collect information are as follows;

  • Guided tours
    • via TYGtickets
  • Mansion House Events
    • via TYGtickets
    • if paying for event admission on the door we would require payment details

If paying for event admission on the door we would require payment details.

  • Hiring the Mansion House
    • name, address
    • event information and signed agreements between yourselves and the City of York Council
    • payment information
  • Newsletter
    • via Mailchimp
  • Customer surveys
    • These are anonymous surveys unless you have requested to be added to the Mansion House newsletter mailing list

When the Mansion House collects your personal data we will ensure;

  • you know why we need the information and have a choice about giving us your personal data
  • we'll only ask for what is necessary to provide the service to you
  • we'll use the data to assist in providing the information you're requesting
  • we'll protect your data and make sure nobody has access to it who should not
  • we'll keep your data secure and ensure that the privacy of individuals is protected

we'll make sure we don’t keep it for longer than is necessary

Top of page

Using personal data

The amount and type of personal data we collect depends on why and how you're contacting or interacting with us, and the service you're requesting.

In some cases you may only need to provide your name and address to access services, in other instances we'll need more details or may require sensitive personal data or special categories of personal data. For example, if you're applying for public health or social services, we may need information about your health.

In many cases laws exists (such as the Local Government Acts and the Localism Act 2011) which say we must/can use your data, and we can do so without your consent or permission - for more information see Statutory duties placed on local government.

For some services we'll use your data under a contract. Where we do not directly provide a service, we may need to pass your personal data onto our contractors. These providers must keep your details safe and secure, and use them only to provide the service - see a list of contracts and companies we deal with.

Online tickets TYG tickets

The Mansion House will receive from TYGtickets the names and contact details of the attendees this will be used to ensure the correct visitor is on the tour and any purchases made beforehand are ready for collection.

Your booking details will be stored by TYGtickets for 12 months after the purchase date and we will be able to access your details on that system.

You can read the TYGtickets' privacy policy online.

Mansion House Newsletter

We will only send you our newsletter where you have given us your consent to do so. If you wish you are able to opt into receiving the Mansion House newsletter, to do this you will need to leave your name and email address. No other details will be required.

The newsletter is compiled by the Mansion House team and distributed via a 3rd party email storage and distribution system currently we use Mailchimp. You are able to opt out of receiving Mansion House emails at any time by contacting [email protected] or unsubscribing via Mailchimp.

We operate CCTV at the Mansion House and you can find more details about this at CCTV Privacy Notice – City of York Council

We may be required or permitted, under data protection legislation, to disclose your personal data without your explicit consent. For example, if we have a legal obligation to do so, such as law enforcement, regulation and licensing, criminal prosecutions and court proceedings.

We must protect public funds and may use personal data and data-matching techniques to detect and prevent fraud, collect taxes and ensure public money is targeted and spent in the most appropriate and cost-effective way. To do this, your personal data may be shared with other bodies responsible for auditing or administering public funds, including the Department for Work and Pensions, HM Revenue and Customs, the Police and other local authorities.

We may monitor and record electronic communications (website, email and phone conversations) for a number of reasons, for example, records of conversations or detection, investigation and prevention of crime. We'll inform you if your call is being recorded or monitored.

Consultation and survey privacy notices

If we ask you to take part in consultation eg a survey, we will notify you as part of the consultation or survey and we will publish the associated privacy notice on York Open Data:

Top of page

Retaining personal data

We will only keep your information for as long as is necessary and then we will delete or destroy it securely.

Where required or appropriate to, at the end of the retention period, we will pass onto the City Archives any relevant information.

At the end of the retention period, we may pass any relevant information to the City Archives where it is required or appropriate to do so.

Top of page

Transferring personal data abroad

We may process your personal data using services hosted outside the European Economic Area, but only where a data processing agreement is in place that complies with obligations equivalent to the principles of the Data Protection Act 2018.

Where we host virtual meetings, using Zoom Pro or Business version of Zoom to host meetings (version 5 and they are recorded, recordings will be kept locally on our server and will not be retained by Zoom.

Some personal data will be stored securely on Zoom’s system in the USA (that is, outside the EEA) in compliance with the EU, USA Privacy Shield Framework. This data may include a user's:

  • name
  • email address
  • telephone number where applicable
  • IP address
  • MAC address
  • other device ID (UDID)
  • device type
  • operating system type and version
  • client version
  • type of camera, microphone or speakers
  • connection type

Zoom does not sell personal data to third parties; collects only the personal data required to provide Zoom services; and retains that data only for so long as is necessary for the provision of those services.

View Zoom’s certification.

View Zoom’s privacy policy.

Top of page

Further processing of personal data

Before we use personal data for a new purpose (not covered by this privacy notice or any of our service privacy notices), we'll provide a new notice to set out the relevant purposes and processing conditions. Where and whenever necessary, we'll seek your prior consent to new processing.

Top of page

Your rights relating to personal data

When we collect your personal data we'll tell you how we are going to use it. Where we process your personal data, you have a number of rights under data protection law.

See further details of your rights relating to personal data.

Top of page

Visiting our website and links to other websites

We are the sole owner of the information collected via our website. It does not store or capture personal data of users with general public access, but does log the IP address of a visitor. This enables us to determine which pages are being viewed and helps us to improve our services. It does not use cookies for the general running of the website, but does use them to enable requested services (for example, payments) and to remember choices during the visit. Anonymous information about page visits is collected using Google Analytics.

Our website privacy notice does not cover external websites; we encourage you to read the privacy notices on any other websites you visit.

Our website also lists email addresses for external organisations (those addresses that don't contain ''); we cannot guarantee what will happen to your personal data if you email an external organisation.

Top of page


By using our website you are consenting to certain types of cookie being placed on your device. See our Cookies Policy.

Where our website links to external resources or websites, these may add their own cookies. These are outside our control. Cookies can be disabled by changing the settings in your browser, but you may need to re-enter information at times.

Top of page


Emails that we send to you or you send to us, may be retained as a record of contact and your email address stored for future use in accordance with our record retention schedules. If we need to email sensitive or confidential information to you, we may perform checks to verify the correct email address and may take additional security measures.

Top of page

Unsolicited mail

You will not receive unsolicited paper or electronic mail as a result of sending us any personal data while using our website, unless you have given us permission to do this.

Top of page