This notice should be read in conjunction with our corporate privacy notice.
Who are we?
North Yorkshire Council is a ‘Data Controller’ as defined by Article 4(7) of the UK General Data Protection Regulation (UK GDPR).
What personal information do we collect?
In order to deliver these planning services to our residents, we need to collect both personal and special category data depending on the specific service being delivered.
Personal data may include:
- name and contact details
- addresses
- date of birth
- case history
- financial information
- family and relationship details
- educational history
- photographs or video recordings
Special category data may include:
- racial or ethnic origin
- religious or philosophical beliefs
- health information (including dietary requirements, allergies and health conditions)
- sex life information
- sexual orientation information
Criminal conviction and offence history data may include:
- criminal offence data (including Disclosure Barring Service (DBS), Access NI or Disclosure Scotland checks)
- health and safety information
Why do we collect your personal information and what is our lawful basis for processing?
We need to collect this information in order to fulfil our obligations in regard to the provision of the following services:
Economic development, business and partnerships
Purpose
The economic development, business and partnerships function covers:
- economic development
- business growth, community regeneration, tourism, museums, heritage, leisure and arts and culture
The role of the function is to promote and support businesses, support growth and unlock economic potential in North Yorkshire. Delivery of this service can take the form of advice, guidance, information, events, capacity building, grants and the delivery of projects.
Lawful basis
UK GDPR Article 6 (1)(a) – processing is under consent where you have opted in to receive general updates from our service, such as newsletters or marketing material.
UK GDPR Article 6(1)(e) – processing is necessary for the performance of a task carried out in the public interest.
Apprenticeship hub
Purpose
This information is required to fulfil the match funding criteria of the European Structural and Investment Fund (ESIF) and to administer the project.
Lawful basis
Article 6 (1)(f) - processing is necessary for our legitimate interests or the legitimate interests of a third party.
Community renewal fund
Purpose
Your personal data is being collected as an essential part of the UK community renewal fund bidding process, so that the ministry of housing, communities and local government and North Yorkshire Council can contact you regarding your bid and for monitoring purposes.
Lawful basis
UK GDPR Article 6(1)(e) – processing is necessary for the performance of a task carried out in the public interest.
Community grants
Purpose
We collect and process the information in order to be able to process your application and make decisions in relation to your grant.
We collect your contact information to be able to contact you in relation to your application and to manage the scheme when successful applicants are awarded funding.
Lawful basis
UK GDPR Article 6(1)(e) – processing is necessary for the performance of a task carried out in the public interest.
Stronger communities
Purpose
The stronger communities programme (‘the programme’) supports communities to play a greater role in the delivery of services in North Yorkshire. Stronger communities offers a package of support, including grants, to help ensure there are the capacity and skills available to enable communities to work with the council to take a greater role in managing and delivering a range of services, aimed at improving the well-being of people of all ages.
Lawful basis
UK GDPR Article 6(1)(b) - processing is necessary for a contract you have with the individual, or because they have asked you to take specific steps before entering into a contract.
Covid-19 business support grants
Purpose
During the Covid-19 pandemic, the government announced a set of financial measures to provide support to businesses that experienced increased costs or disruptions to their cash flow as a result of Covid-19. If you previously applied or chose to apply for financial support, the council processed your personal data to assess whether your business is eligible to receive financial support and if so, to provide a payment to you.
Lawful basis
UK GDPR Article 6 (1)(c) – processing is necessary for compliance with a legal obligation to which the controller is subject.
UK GDPR Article 6(1)(e) – processing is necessary for the performance of a task carried out in the public interest.
Refugee employment
Purpose
North Yorkshire council would like to provide you with advice about your employment with the intention of finding you paid work within North Yorkshire.
Lawful basis
UK GDPR Article 6 (1)(a) – processing is under consent where you have opted in to receive general updates from our service, such as advice, newsletters, or marketing material.
More for Eastfield
Purpose
More for Eastfield project is a CLLD funded project which is a partnership of local organisations who are working together to support residents who need help to get into work or training.
The council collects personal information of all the clients who would like to sign up for the MORE project for the following reasons:
- to enable clients to gain access to the support provided by the project
- to signpost clients to support which is provided by the council or external organisations
- to assess eligibility for the project
- to evidence the council’s participation in the more for Eastfield CLLD project, client details are recorded for statistical and contractual purposes.
Lawful basis
UK GDPR Article 6 (1) (a) - the data subject has given consent to the processing of his or her personal data for one or more specific purposes. For example, you have agreed to allow us to use your information in a case study.
UK GDPR article 6 (1)(b)-processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
UK GDPR Article 6 (1) (c) -processing is necessary for compliance with a legal obligation to which the controller is subject.
UK GDPR Article 6 (1) (f)- processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party.
Who do we share this information with?
In the course of delivering the above stated services, we may need share your information with a number of external agencies who are key to delivering our services. These include:
- local and central government agencies, such as the Department for Business, Energy and Industrial Strategy, the Department for Education, His Majesty’s Treasury, the Department for Environment, Food and Rural Affairs (DEFRA) and the Department of Work and Pensions
- European Structural and Investment Fund (ESIF)
- the council’s approved voluntary and community sector infrastructure support organisation – Community First Yorkshire
- appointed evaluation consultant(s) – if required for programme evaluation
- we may share information for the purpose of counter fraud activity and debt recovery with other government departments, agencies and/or local authorities
- we will only pass on your data to other organisations for the purpose of finding you employment with your consent and we will not sell your data to third parties for marketing purposes
We will also share data appropriately with other agencies in the following circumstances:
- where there is a serious risk of harm to you or others
- where there are concerns for the welfare of an adult at risk
- where a court requires us to share information about you.
How long do we keep your information for?
The following table details the retention periods for records relating to the specific services stated above:
Economic development, business and partnerships
| Data held | Retention period |
|---|---|
| Contact details for general communications | Until the service ends or the individual requests removal or unsubscribes |
| Grant awards – council funds | Year record created plus 3 years |
| Grant awards – externally sourced funding delivered and administered by the council | Details will be retained for the duration of the council’s contractual obligation |
Apprenticeship hub
| Data held | Retention period |
|---|---|
| Contact details and DfE unique learner number | Records will be retained for 10 years after the final ESF claim is paid |
Community renewal fund
| Data held | Retention period |
|---|---|
| Contact details | 2 years from closure of the bidding process |
| Finance information | Year record created plus 6 years |
Community grants
| Data held | Retention period |
|---|---|
| Personal data held regarding unsuccessful applications | 6 months |
| Personal data held regarding successful applications | 6 years following project completion date |
Stronger communities
| Data held | Retention period |
|---|---|
| Information related to a grant or contract | 7 years after grant/contract end |
| Contact data | 2 years |
Covid-19 business support
| Data held | Retention period |
|---|---|
| Personal and business data | The UK government has launched the Covid‑19 public inquiry, so the council must keep relevant information for this purpose. Once the inquiry ends, the information will be disposed of in line with retention rules. |
Refugee employment
| Data held | Retention period |
|---|---|
| Contact and employer details | Year record created plus 6 years |
More for Eastfield
| Data held | Retention period |
|---|---|
| Contact details | The council will retain your personal information in accordance with the organisation’s retention schedule |
Other relevant transparency information
The legislation, policies and guidance that relates to these services include, but is not limited to:
- Local Government Finance Act 2012
Other data that we may hold about you is only kept for as long as is necessary and all data is retained in line with our record retention and disposal schedule (RRDS).
For more information about how we use your data, including your privacy rights and the complaints process, please see our corporate privacy notice.