We keep the Communications Team Privacy Notice under review. It was last reviewed and updated in December 2021.
If you have any questions about this Privacy Notice contact the council’s Data Protection Officer.
View the privacy information for all of the City of York Council (CYC).
- personal data
- using personal data
- sharing personal data
- our legal basis for collecting and sharing personal data
- transferring personal data abroad
- retaining personal data
- further processing of personal data
- your rights relating to personal data
Personal data
The amount and type of personal data we collect from you when you contact us will depend on why and how you are contacting or interacting with us, and the service or information you are requesting.
See further details about how we define personal data and non-personal data.
Using personal data
We use your personal data for the following purpose(s):
- managing, responding and recording enquiries from businesses, media and the public in general
- procuring services at the best price
- in partnership with third party operators, manage information to ensure the safe delivery of events and services
- conducting consultations using data to target research at specific customer groups and profile results by categories of users
- collating information to run reports to monitor trends or identify key themes
- distributing information to you in formats (such as email newsletter, printed mail-out or magazine) you have consented to receive and about subjects that you have consented to hear about
- communicating with you on social media in line with the terms and conditions of those social media sites
- communicating with you about matters of public interest such as emergency situations affecting the city of York
In the case of photos and videos, with your consent we may use this to create communications products such as social media posts, advertising, leaflets, digital marketing and printed marketing.
Sharing personal data
Personal data may be shared with other City of York Council departments or third parties, where necessary to:
- follow up a service request or complaint
- take other action requested by or agreed with you or where legal to do so
Personal data may be shared with other organisations or companies (with your consent, or where the law allows us).
Individual’s names and addresses may be shared with a third party print distribution company in order to distribute information you have requested or agreed to receive, or we have a lawful reason for sending you. We have strict processes to ensure that the information is deleted once it has been used and cannot be used or shared in any way other than for the specific mail-out for which it was provided.
Social media usernames and correspondence, including any additional personal information you include in your social media correspondence with us (such as your address) may be shared with our social media management system suppliers (for example, Meltwater, PRGloo and Hootsuite) in the course of our using these systems. Any data shared in this way is bound by our contracts with our suppliers which ensure information is correctly handled in accordance with data protection laws.
We will use Gov UK Notification services to send out newsletters.
Sharing data under Data Protection legislation
We may be required or permitted, under data protection legislation, to disclose your personal data without your explicit consent, for example if we have a legal obligation to do so, such as for:
- law enforcement
- fraud investigations
- regulation and licensing
- criminal prosecutions
- court proceedings
Our legal basis for collecting and sharing personal data
We use your personal data:
- if you ask us to do something on your behalf
- if you have given us your explicit consent where needed
- if we are carrying out a task in the public interest or in the exercise of official authority vested in the Council as the controller and/or for reasons of public interest in the area of public health
- to comply with a legal obligation
- to carry out our obligations under employment, social security or social protection law, or a collective agreement
- if the processing relates to personal data manifestly made public by the data subject/you
Transferring personal data abroad
As a rule, we do not transfer your personal data to third party processors outside the European Economic Area (EEA).
We may use Zoom Pro or Business version of Zoom (version 5) to host some public facing meetings, training sessions etc across different services in the council. Where these meetings are recorded, recordings will be kept locally on our server and will not be retained by Zoom.
Some personal data will be stored securely on Zoom’s system in the USA (that is, outside the EEA) in compliance with the EU, USA Privacy Shield Framework. This data may include a user's:
- names
- email addresses
- telephone numbers where applicable
- IP address
- MAC address
- other device ID (UDID)
- device type
- operating system type and version
- client version
- type of camera, microphone or speakers
- connection type
Zoom does not sell personal data to third parties; collects only the personal data required to provide Zoom services; and retains that data only for so long as is necessary for the provision of those services.
Retaining personal data
Electronic information is stored securely on our databases, systems or internal drives.
Paper information is kept confidentially and securely in locked storage in the Communication Team’s area in West Offices.
Data you shared with us on social media is stored on those social media sites. You are advised to check the privacy notices or terms and conditions of your social media sites for more information.
Information you voluntarily supplied to us, in order for us to communicate with you, will be kept for 3 years after the matter about which we are processing your personal data has concluded, expired or ceases to be relevant.
Any photos or videos of you, which you have consented for us to use, will be stored on our internal servers for a maximum of 5 years. You can request your photo or video to be deleted at any point before this expiry date.
Photos and videos used on social media and other digital formats are deemed 'published' and in the public domain. Where reasonable and practical we will endeavour to delete such published personal information on request, however we cannot be responsible for any copies of the material created by subsequent sharing by a third party.
When we no longer have the need to keep your personal data we will confidentially and securely destroy it.
At the end of the retention period, we may pass any relevant information to the City Archives where it is required or appropriate to do so.
Further processing of personal data
If we wish to use your personal data for a new purpose, not covered by this Privacy Notice, then we'll provide you with a new notice.
The new notice will:
- explain this new use before we start the processing
- set out the relevant purposes and processing conditions
Where and whenever necessary, we'll seek your consent to the new processing, if we start to use your personal data for a purpose not mentioned in this Privacy Notice.
Your rights relating to personal data
When we collect your personal data we'll tell you how we are going to use it. Where we process your personal data, you have a number of rights under data protection law.
See further details of your rights relating to personal data.