Privacy Notice

Sedgefield Town Council

This privacy notice is intended to inform you of how your personal data will be used in our organisation.  We take your data protection rights seriously and we will only use your personal data in the ways we describe here.

1. Who we are and what we do?
   • We are Sedgefield Town Council, a council in England. Our contact details are Sedgefield Town Council, Council Offices, 13 Front St, Sedgefield, County Durham, TS21 3AT.
   • We are a data controller for personal data as defined by all applicable data protection and privacy laws including, but not limited to, the retained EU law version of the General Data Protection Regulation ((EU) 2016/679) (the “UK GDPR”), as it forms part of the law of England and Wales, Scotland, and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 as amended, and any successor legislation (the “Data Protection Legislation”).
   • We are not required to have a Data Protection Officer as defined by Article 37 of the UK GDPR.
   • We process your personal data to enable us to manage our organisation and provide a service to you and others.

1. Your data protection rights
   • Under the data protection legislation, you have rights including:
     • Your right to be informed - You have the right to be informed of our use of your personal data. This notice is designed to give you that information.  If you require further information please contact us using the details below.
     • Your right of access - You have the right to ask us for copies of your personal information.
     • Your right to rectification - You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
     • Your right to erasure - You have the right to ask us to erase your personal information in certain circumstances.
     • Your right to restriction of processing - You have the right to ask us to restrict the processing of your information in certain circumstances.
     • Your right to object to processing - You have the right to object to the processing of your personal data in certain circumstances.
     • Your right to data portability - You have the right to ask that we transfer the information you gave us to another organisation, or to you, in certain circumstances.
     • Your right in relation to automated decision-making including profiling - We do not process personal data in this way.
   • You are not required to pay any charge for exercising your rights. If you make a request, the law gives us one month to respond to you but we have undertaken to respond as soon as possible and in any case one month.
   • Please contact us using the details in Section 1 above if you wish to make a request.

1. What data does the data protection legislation cover?
   • Data protection legislation is to protect the data privacy of individuals and uphold your rights over your own personal data.
   • Definitions:
     • Personal Data - means any information relating to an identified or identifiable person (‘data subject’); an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that person.
     • Processing - means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
     • Data Controller - means the person or organisation which, alone or jointly with others, determines the purposes and means of the processing of personal data.
     • Data Processor - means a person or organisation which processes personal data on behalf of the Data Controller.
     • Third Country - means a country or territory outside the United Kingdom.
     • Lawful Basis - means one of the six lawful reasons to process personal data as set out in Article 6 of the UK GDPR. At least one of these will apply whenever we process your personal data.
2. Why do we have your information and how long will we keep it?
   • We take your data privacy seriously and will only use your personal data for the purpose for which it was collected.
   • For every activity that we undertake using personal data we must be clear what our purpose is for that activity and have a Lawful Basis to process your data.
   • Where we process personal data that reveals special category data (article 9 UK GDPR) or personal data relating to criminal convictions and offences (article 10 UK GDPR) we require an additional condition to process.
   • We collect and process your personal data for the following purposes for which we collect certain categories of data and in order to lawfully process your data for those purposes we rely on these lawful bases and additional conditions.

If we have relied on ‘consent’ to process your personal data, you are able to withdraw that consent at any time and we will be happy to assist you.

We collect data in the following ways

How long we intend to keep your data

• When we no longer need your personal data to undertake our stated purpose we will delete it or anonymise it so that it no longer permits the identification of you.
• Personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with UK GDPR Article 89(1).
• In some cases we may be allowed to use your personal data to contact you with news about our activities, products or services. We will always offer an opt out and we will always comply with the data protection legislation.

5. Sharing this information with other data controllers
   • We may share your data with another data controller if that controller takes over the purpose for which we collected your data.
   • We may be required to share your personal data for legal, judicial, law enforcement or government reasons.
   • We routinely share personal data with other data controllers for the following reasons.

• We may share your personal data with other data controllers to enable us to fulfil our obligations to you or to provide a product or service, in that event we will tell you who we are going to share your data with.
• We take your data protection rights seriously and will take steps to ensure that those we share data with process it responsibly.

6. Data processors working on our behalf
   • We may send your data to a data processor to undertake data processing activities on our behalf.
   • We send personal data to data processors for the following reasons.

7. Where do we store and process your personal data?
   • Most of your personal data will be stored and processed here in the UK.
   • Some data may be stored or processed in other third countries. We have made sure that safeguards are in place or such transfers to ensure that an equivalent standard of data protection is in place.
     • Personal data transferred to EU member states, Iceland, Norway, Liechtenstein, Gibraltar, Andorra, Argentina, Faroe Islands, Guernsey, Isle of Man, Israel, Jersey, New Zealand, Switzerland, Uruguay, Japan (only private sector organisations) or Canada (only covers data that is subject to Canada's Personal Information Protection and Electronic Documents Act) is transferred to those third countries on the basis of adequacy regulations.
     • Personal data transferred to USA organisations certified to the “UK Extension to the EU-US Data Privacy Framework” is transferred on the basis allowed for by Article 45 of the UK General Data Protection Regulation (GDPR).
     • Personal data transferred to other USA organisations and all other countries is transferred on the basis of International Data Transfer Agreements (IDTAs) where there is a contract incorporating an agreement recognised or issued in accordance with the data protection legislation. The IDTA contains contractual obligations on us (the data exporter) and the receiver (the data importer), and rights for the individuals whose personal data is transferred.

8. How to contact us for more information
   • We hope that you will feel that we have explained our use of your personal data adequately to you, however if you have any questions, wish to exercise any of your data protection rights or have a complaint please contact us at Sedgefield Town Council, 13 Front St, Sedgefield, County Durham, TS21 3AT
   • You can also complain to the Information Commissioner’s Office (ICO) if you are unhappy with how we have used your data. Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF Helpline number: 0303 123 1113

8. Updates to this notice
   • We might have to make changes to this Privacy Notice if there are changes to how we process your personal data or the data protection legislation changes.
   • Changes will be made available via updated notices on the Sedgefield Town Council Website and at the Sedgefield Town Council offices at the above address.