This notice should be read in conjunction with our corporate privacy notice.
Who are we?
North Yorkshire Council is a ‘Data Controller’ as defined by Article 4(7) of the UK General Data Protection Regulation (UK GDPR).
What personal information do we collect?
In order to deliver these services to our residents and commercial customers, we need to collect both personal and special category data depending on the specific service being delivered.
Personal data may include:
- names and contact details
- addresses
- date of birth
- case details and case history
- financial information
- education history (for example, qualifications)
- photographs or video recordings
- video and CCTV recordings of public areas
- call recordings
- identification documents
Special category data may include:
- racial or ethnic origin
- religious or philosophical beliefs
- health information (including dietary requirements, allergies and health conditions)
- sex life information
- sexual orientation information
Why do we collect your personal information and what is our lawful basis for processing?
We need to collect this information in order to fulfil our obligations in regard to the provision of the following services:
Service
North Yorkshire Education Services (NYES)
Purpose
We collect this data to keep you up to date with any changes to services you purchase from us and, where you have requested, we will also use this data to provide you with relevant news from NYES and developments within the business.
Lawful basis
UK GDPR Article 6(1)(a) – processing is under consent where you have opted in to receive general updates from our service, such as newsletters or marketing material.
UK GDPR Article 6(1)(b) – processing is necessary for a contract you have with the individual.
UK GDPR Article 6(1)(f) – processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party.
Service
Facilities management
Purpose
We need to collect your personal data to facilitate delivery and management of the following services:
- public lighting - to facilitate the repair of faults and ensure the operation of public lighting
- street name plates - to facilitate the installation and repair of street name plates
- markets - to enable communication with traders on market matters and facilitate the payment of pitch fees
Lawful basis
UK GDPR Article 6(1)(e) – processing is necessary for the performance of a task carried out in the public interest
Service
Evron Centre and Falsgrave Community Resource Centre
Purpose
The Evron Centre and Falsgrave community resource centres offer a range of services, including room hire, equipment hire, internet usage and office space.
Lawful basis
UK GDPR Article 6(1)(b) – processing is necessary for a contract you have with the individual.
UK GDPR Article 6(1)(f) – processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party.
Service
Filey Brigg Camping and Caravan Site
Purpose
Filey Brigg camping and caravan site offers a range of services, including site bookings for caravans and camping. Your information is required to manage booking requests and purchases, to manage payments and fees and to communicate with you regarding bookings and purchases.
For the processing of personal data in relation to CCTV, the council relies upon the following:
Lawful basis
UK GDPR Article 6(1)(b) – processing is necessary for a contract you have with the individual
UK GDPR Article 6(1)(e) – processing is necessary for the performance of a task carried out in the public interest
UK GDPR Article 6(1)(f) – processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party.
UK GDPR Article 6 (1)(e)- processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
Service
Special diets
Purpose
NYES catering provide catering to primary and secondary schools in North Yorkshire and surrounding counties. We collect Information on Special Diets and Food Allergens / Intolerances for children and young people requiring a school meal.
Lawful basis
UK GDPR Article 6(1)(e) – processing is necessary for the performance of a task carried out in the public interest.
UK GDPR Article 9(2)(i) – processing is necessary for reasons of public interest in the area of public health
Who do we share this information with?
In the course of delivering the above stated services, we may need share your information with a number of external agencies who are key to delivering our services. These include:
- schools
- CCTV recordings may be shared with the DVLA, HM Court Service and Insurance companies.
How long do we keep your information for?
North Yorkshire Education Services (NYES)
| Data held | Retention period |
|---|---|
| We collect only minimal personal data related to your job role, limited to your job title, work address, email address and telephone number | 5 years |
Facilities management
| Data held | Retention period |
|---|---|
| Financial information | 7 years |
| Public lighting fault reports | Year record created plus 2 years |
| Street name plates | Year record created plus 2 years |
| Market traders | For the period that a trader is included on our mailing list of regular and casual market traders |
Evron Centre and Falsgrave Community Resource Centre
| Data held | Retention period |
|---|---|
| Name and contact details | The council will keep your personal information only for as long as required, in line with its retention schedule and legal requirements |
| Booking requests and purchases | The council will keep your personal information only for as long as required, in line with its retention schedule and legal requirements |
| Payments and fees | The council will keep your personal information only for as long as required, in line with its retention schedule and legal requirements. |
Filey Brigg Camping and Caravan Site
| Data held | Retention period |
|---|---|
| Name and contact details | The council will keep your personal information only for as long as required, in line with its retention schedule and legal requirements |
| Booking requests and purchases | The council will keep your personal information only for as long as required, in line with its retention schedule and legal requirements |
| Payments and fees | The council will keep your personal information only for as long as required, in line with its retention schedule and legal requirements |
| CCTV | 6 months |
CCTV
| Data held | Retention period |
|---|---|
| Name and contact details | The council will keep your personal information only for as long as required, in line with its retention schedule and legal requirements |
| Booking requests and purchases | The council will keep your personal information only for as long as required, in line with its retention schedule and legal requirements |
| Payments and fees | The council will keep your personal information only for as long as required, in line with its retention schedule and legal requirements. |
Special diets
| Data held | Retention period |
|---|---|
| Photograph of child | Retained for length of the special diet requirement |
| Photograph of what the child has eaten on a daily basis | Completion of school term |
| Name of child | Reviewed on yearly basis or when any changes are made to special diet requirements or allergies |
| Special dietary requirements / allergens specific to the child | Reviewed on yearly basis or when any changes are made to special diet requirements or allergies |
| Names and addresses of the parent / carer on the SD1 form | Held for a year and then returned back to the school |
Other relevant transparency information
The legislation, policies and guidance that relates to these services include, but is not limited to:
- Food Information Regulations (England) 2022
- The Local Government Act 1972
- The Public Health Act 1925
- The Towns Improvement Clauses Act 1847
Other data that we may hold about you is only kept for as long as is necessary and all data is retained in line with our record retention and disposal schedule (RRDS).
For more information about how we use your data, including your privacy rights and the complaints process, please see our corporate privacy notice.