City of York Council (CYC) complies with the UK General Data Protection Regulations (UK GDPR) and the Data Protection Act 2018, and is registered with the Information Commissioner’s Office (ICO), reference: Z5809563.
We regularly update the Skills Team Events Privacy Notice; it was last updated in July 2023.
CYC is the controller for the personal data we process, unless otherwise stated. You can contact us.
You can find more information about the role of the Data Protection Officer (DPO) in the Our Data Protection Policy Statement.
This privacy notice should be read in conjunction with other relevant specific privacy notices that are available at our privacy notice.
When appropriate we will provide a ‘just in time’ notice to cover any additional processing activities not mentioned in this privacy notice.
- personal data
- using personal data
- sharing personal data
- our legal basis for collecting and sharing personal data
- transfers of personal data
- retaining personal data
- further processing of personal data
- your rights relating to personal data
Personal data
The amount and type of personal data we collect from you will depend on the type of event, and the service or information you are requesting.
See further details about how we define personal data and non-personal data.
Using personal data
We use your personal data for the following purpose(s):
- collating non-identifiable information to run reports to monitor trends or identify key themes
- in partnership with third party operators, manage information to ensure the safe delivery of events and services
- managing, responding and recording enquiries from businesses and the public in general
- distributing information to you in formats (such as email or e-newsletter) you have consented to receive and about subjects that you have consented to hear about
- communicating with you on social media in line with the terms and conditions of those social media sites
- conducting consultations using data to target research at specific customer groups and profile results by categories of users
We may use information from events in presentations, statistics and reports. Any presentations, reports and statistics for publication or use outside of the authorised council staff, will be anonymised and cannot be linked back to you or individuals. Reports containing anonymous information may also be shared with the general public and other organisations.
In the case of photos and videos, with your consent we may use this to create communications products such as social media posts, advertising, leaflets, digital marketing and printed marketing.
Where we use platforms, systems or apps such as Eventbrite, WhatsApp and others to contact you, hold meetings and more, we'll let you know. You can find out more about these platforms, systems or apps in their privacy notices:
When we use MS Teams to provide secure online conversations or meetings, we may record and or transcribe these. You can find out more about this in the Microsoft Office 365 (MS365) Teams Meeting recording and transcription privacy notice.
Sharing personal data
We will share your personal data with other council services as appropriate, and with other organisations, commissioned partners or contractors who undertake work on our behalf.
We only allow our commissioned partners, contractors and third parties to handle your personal data if we are satisfied, they take appropriate measures to protect it.
We do not pass or sell personal data to third parties for marketing, sales, or any other commercial purposes.
Social media usernames and content you post regarding the Skills Team events may be shared on our social media with your consent.
Sharing data under Data Protection legislation
We may be required or permitted, under data protection legislation, to disclose your personal data without your explicit consent, for example if we have a legal obligation to do so, such as for:
- safeguarding
- law enforcement
- fraud investigations
- regulation and licensing
- criminal prosecutions
- court proceedings
Our legal basis for collecting and sharing personal data
Any personal data including special category data that we process about individuals is done so in accordance with Article 6 and 9 of the UK GDPR and Schedule 1 of the Data Protection Ac 2018 (DPA 2018).
The legal basis for processing your personal data is in accordance with the following:
- Article 6(1)(a) – your consent
- Article 6(1)(c) so we can comply with our legal and statutory duties
- Article 6(1)(e) for the performance of our public task
- Article 6(1)(f) for the purposes of our legitimate interest
Where the information we process is special category data, for example health data, the additional bases for processing that we rely on are:
- Article 9(2)(a) your explicit consent
- Article 9(2)(b) which relates to carrying out our legal obligations
- Article 9(2)(e) – Processing relates to personal data manifestly made public by the data subject
- Article 9(2)(g) – where processing is necessary for reasons of substantial public interest
Some of the Schedule 1 conditions for processing special category data require an Appropriate Policy Document (APD) to be in place, that sets out and explains the procedures for securing compliance with the principles in Article 5 and policies regarding the retention and erasure of such personal data. This document explains this processing and satisfies the requirements of Schedule 1, Part 4 of the DPA 2018 and supplements this privacy notice. You can find this in our Appropriate Policy Document.
Transfers of personal data
We don’t routinely transfer personal data outside of the UK, but when this is necessary we ensure that we have appropriate safeguards in place and that is done in accordance with the UK data protection and privacy legislation.
Retaining personal data
Electronic information is stored securely on our databases, systems or internal drives.
Paper information is kept confidentially and securely in locked storage in the Skills Team’s area in West Offices.
Data you shared with us on social media is stored on those social media sites. You are advised to check the privacy notices or terms and conditions of your social media sites for more information.
Any photos or videos of you, which you have consented for us to use, will be stored on our internal servers for a maximum of 5 years. You can request your photo or video to be deleted at any point before this expiry date.
Photos and videos used on social media and other digital formats are deemed 'published' and in the public domain. Where reasonable and practical we will endeavour to delete such published personal information on request, however we cannot be responsible for any copies of the material created by subsequent sharing by a third party.
When we no longer have the need to keep your personal data we will confidentially and securely destroy it.
At the end of the retention period, we may pass any relevant information to the City Archives where it is required or appropriate to do so.
Further processing of personal data
If we wish to use your personal data for a new purpose, not covered by this Privacy Notice, then we'll provide you with a new notice.
The new notice will:
- explain this new use before we start the processing
- set out the relevant purposes and processing conditions
Where and whenever necessary, we'll seek your consent to the new processing, if we start to use your personal data for a purpose not mentioned in this Privacy Notice.
Your rights relating to personal data
When we collect your personal data we'll tell you how we are going to use it. Where we process your personal data, you have a number of rights under data protection law.
See further details of your rights relating to personal data.
Also see
- Website terms and disclaimer
- Data Protection Policy Statement
- Accessibility statement
- Cookies policy
- Copyright statement