York Customer Centre Test and Trace Privacy Notice

We keep the York Customer Centre Test and Trace Privacy Notice under review. It was last reviewed and updated in August 2020.

If you have any questions about this Privacy Notice contact the council’s Data Protection Officer.

View the privacy information for all of the City of York Council (CYC).


The UK is currently experiencing a public health emergency as a result of the coronavirus (COVID-19) pandemic. It is therefore critical that organisations take a range of measures to keep everyone safe.

The easing of social and economic lockdown measures following the COVID-19 outbreak is being supported by NHS Test and Trace. The Department of Health and Social Care has asked organisations including City of York Council to support this service by keeping a temporary record of our customers and visitors for 21 days. In the event of a local outbreak of the virus this data may be used to assist NHS Test and Trace as needed. This could help contain clusters or outbreaks.


Personal data

The Department for Health and Social Care are clear that the NHS Test and Trace programme is a voluntary scheme and nobody visiting our premises is required to provide their details. If you do not want any booking details you have supplied to be used for Test and Trace purposes please make this clear to a member of staff at the time of your visit.

Although this is a voluntary scheme we strongly encourage our customers and visitors to share their details in order to support NHS Test and Trace - this information will only be used where necessary to help stop the spread of COVID-19.

The accuracy of the information provided will be the responsibility of the individual who provides it. The Council will not verify any customer’s or visitor’s identity for NHS Test and Trace purposes.

We already collect and process information about persons visiting council premises, including for public functions, tours, weddings and meetings, and the types of information we collect and use from our customers and visitors includes:

  • the name of the customer or visitor
  • if there is more than one person, then we can record the name of the ‘lead member’ of the group and the number of people in the group
  • a contact phone number for each customer or visitor, or for the lead member of a group of people
  • date of visit, arrival time and, where possible, departure time
  • if a customer will interact with only one member of staff, the name of the assigned staff member will be recorded alongside the name of the customer

Recording both arrival and departure times (or estimated departure times) will help reduce the number of customers or visitors needing to be contacted by NHS Test and Trace. We recognise, however, that recording departure times will not always be practicable.

We receive information from persons entering Council premises or booked to attend a function, tour, event or meeting at our premises.

There is a separate privacy notice for employees and staff.

See further details about how we define personal data and non-personal data.


Our legal basis for using personal data

The Council is processing this personal information for NHS Test and Trace, as it is necessary for the performance of a task carried out in the public interest in accordance with Article 6 1 (e) of the General Data Protection Regulation.

The Council will not process any special category data for this purpose.


Sharing personal data

In the event of a local outbreak of the corona virus names and contact details of customers and visitors to our sites will only be provided to the NHS to support Test and Trace when they ask for these records either because someone who has tested positive for COVID-19 has listed Council premises as a place they visited recently, or because our premises have been identified as the location of a potential local outbreak of COVID-19.

NHS Test and Trace will work with you, if contacted, to ensure that information is shared in a safe and secure way. See further information on how NHS Test and Trace works.

Contact from NHS Test and Trace

NHS Test and Trace will handle all data according to the highest ethical and security standards and ensure it is used only for the purposes of protecting public health, including minimising the transmission of COVID-19.

If you are contacted by NHS Test and Trace Contact tracers will:

  • call you from 0300 013 5000
  • send you text messages from ‘NHStracing’
  • ask you to sign in to the NHS Test and Trace contact-tracing website

Contact tracers will never:

  • ask you to dial a premium rate number to speak to them (for example, those starting 09 or 087)
  • ask you to make any form of payment or purchase a product or any kind
  • ask for any details about your bank account
  • ask for your social media identities or login details, or those of your contacts
  • ask you for any passwords or PINs, or ask you to set up any passwords or PINs over the phone
  • disclose any of your personal or medical information to your contacts
  • ask about protected characteristics that are irrelevant to the needs of test and trace
  • provide medical advice on the treatment of any potential coronavirus symptoms
  • ask you to download any software to your PC or ask you to hand over control of your PC, smartphone or tablet to anyone else
  • ask you to access any website that does not belong to the government or NHS

Retaining personal data

We will keep the information you give us in the council’s secure network drive and make sure it can only be accessed by authorised staff.

The council will only keep the information which is collected and stored solely for NHS Test and Trace for 21 days. This reflects the incubation period for COVID-19 (which can be up to 14 days) and an additional 7 days to allow time for testing and tracing. After 21 days, this information will be securely disposed of or deleted.


Further processing of personal data

If we wish to use your personal data for a new purpose, not covered by this Privacy Notice, then we'll provide you with a new notice.

The new notice will:

  • explain this new use before we start the processing
  • set out the relevant purposes and processing conditions

Where and whenever necessary, we'll seek your consent to the new processing, if we start to use your personal data for a purpose not mentioned in this Privacy Notice.


Your rights relating to personal data

When we collect your personal data we'll tell you how we are going to use it. Where we process your personal data, you have a number of rights under data protection law.

See further details of your rights relating to personal data.


Also see

Data Protection Officer

West Offices, Station Rise, York, YO1 6GA

Telephone: 01904 554145