Your council

Mansion House Privacy Notice

We keep the Mansion House Privacy Notice under review. It was last reviewed and updated in April 2022.

If you have any questions about this Privacy Notice contact the council’s Data Protection Officer.

View the privacy information for all of the City of York Council (CYC).

Collecting personal data

We will only ask you for the information that is necessary to provide you with the service you are contacting us about and to provide the best possible service to you.

The areas where we would collect information are as follows;

  • Guided tours
    • via TYGtickets
  • Mansion House Events
    • via TYGtickets
    • if paying for event admission on the door we would require payment details

If paying for event admission on the door we would require payment details.

  • Mansion House private hirer
    • name, address
    • event information and signed agreements between yourselves and the City of York Council
    • payment information
  • Newsletter
    • via Mailchimp
  • Customer surveys
    • These are anonymous surveys unless you have requested to be added to the Mansion House newsletter mailing list

When the Mansion House collects your personal data we will ensure;

  • you know why we need the information and have a choice about giving us your personal data
  • we'll only ask for what is necessary to provide the service to you
  • we'll use the data to assist in providing the information you're requesting
  • we'll protect your data and make sure nobody has access to it who should not
  • we'll keep your data secure and ensure that the privacy of individuals is protected
  • we'll make sure we don’t keep it for longer than is necessary

Our legal basis for using personal data

We collect and use your information because you are asking us to do something on your behalf. We may not be able to do what you have asked us to do if you do not provide us with your information and use it as described in this privacy notice.

We will only send you our newsletter where you have given us your consent to do so.

Sharing personal data

Online tickets TYG tickets

Since the easing of restrictions around COVID-19 it is no longer a requirement that you pre-book. However, if you wish to pre-book you can do so online through TYGtickets who have been appointed to handle this process on behalf of the Mansion House.

The Mansion House will receive from TYGtickets the names and contact details of the attendees this will be used to ensure the correct visitor is on the tour and any purchases made beforehand are ready for collection.

Your booking details will be stored by TYGtickets for 12 months after the purchase date and we will be able to access your details on that system.

You can read the TYGtickets' privacy policy online.

Mansion House Newsletter

If you wish you are able to opt into receiving the Mansion House newsletter, to do this you will need to leave your name and email address. No other details will be required.

The newsletter is compiled by the Mansion House team and distributed via a 3rd party email storage and distribution system currently we use Mailchimp. You are able to opt out of receiving Mansion House emails at any time by contacting or unsubscribing via Mailchimp.

Sharing data under Data Protection legislation

We may be required or permitted, under data protection legislation, to disclose your personal data without your explicit consent, for example if we have a legal obligation to do so, such as for:

  • law enforcement
  • fraud investigations
  • regulation and licensing
  • criminal prosecutions
  • court proceedings

Retaining personal data

We will only keep your information for as long as is necessary and then we will delete or destroy it securely.

Where required or appropriate to, at the end of the retention period, we will pass onto the City Archives any relevant information.

At the end of the retention period, we may pass any relevant information to the City Archives where it is required or appropriate to do so.

Further processing of personal data

If we wish to use your personal data for a new purpose, not covered by this Privacy Notice, then we'll provide you with a new notice.

The new notice will:

  • explain this new use before we start the processing
  • set out the relevant purposes and processing conditions

Where and whenever necessary, we'll seek your consent to the new processing, if we start to use your personal data for a purpose not mentioned in this Privacy Notice.

Your rights relating to personal data

When we collect your personal data we'll tell you how we are going to use it. Where we process your personal data, you have a number of rights under data protection law.

See further details of your rights relating to personal data.

COVID-19 and NHS Test and Trace

The UK is currently experiencing a public health emergency as a result of the coronavirus (COVID-19) pandemic. It is therefore critical that organisations take a range of measures to keep everyone safe.

The easing of social and economic lockdown measures following the COVID-19 outbreak is being supported by NHS Test and Trace. The Department of Health and Social Care has asked organisations including City of York Council to support this service by keeping a temporary record of our visitors for 21 days. In the event of a local outbreak of the virus this data may be used to assist NHS Test and Trace as needed. This could help contain clusters or outbreaks.

The Department for Health and Social Care are clear that this is a voluntary scheme and nobody visiting our premises is required to provide their details. If you do not want any booking details you have supplied to be used for Test and Trace purposes please make this clear to a member of staff at the time of your visit.

Although this is a voluntary scheme we strongly encourage our customers and visitors to share their details in order to support NHS Test and Trace - this information will only be used where necessary to help stop the spread of COVID-19.
The accuracy of the information provided will be the responsibility of the individual who provides it. The Council will not verify any visitor’s identity for NHS Test and Trace purposes.

In the event of a local outbreak of COVID-19 names and contact details of visitors to our sites will only be provided to the NHS to support Test and Trace when they ask for these records either because someone who has tested positive for COVID-19 has listed Council premises as a place they visited recently, or because our premises have been identified as the location of a potential local outbreak of COVID-19.

NHS Test and Trace will work with you, if contacted, to ensure that information is shared in a safe and secure way.

How NHS Test and Trace works

NHS Test and Trace will handle all data according to the highest ethical and security standards and ensure it is used only for the purposes of protecting public health, including minimising the transmission of COVID-19.

Legal Basis for Processing for NHS Test and Trace

The Council is processing this personal information for example, sharing with NHS Test and Trace, as it is necessary for the performance of a task carried out in the public interest in accordance with Article 6 1 (e) of the General Data Protection Regulation.

The Council will not process any special category data for this purpose.

Data Retention Period for NHS Test and Trace

The council will only keep the information which is collected and stored solely for NHS Test and Trace for 21 days. This reflects the incubation period for COVID-19 (which can be up to 14 days) and an additional 7 days to allow time for testing and tracing. After 21 days, this information will be securely disposed of or deleted.

Also see