Data Protection Policy

Service Specific Privacy Notice

Service: Tourism

The following information provides details on how we may collect use and where appropriate share personal information in accordance with the General Data Protection Regulations (GDPR). It should be read in conjunction with North Yorkshire Council’s privacy notice document.

We obtain information about you when you use our website, for example, when you contact us about products and services, or if you register to receive one of our newsletters. We will also collect information from you when you use any of our products and services or receive support from us.

Why we collect your personal data

We collect your personal data to understand your needs and provide you with a better service. We may use your information for the following reasons:

to process accommodation bookings via one of many inward polling companies
for attractions and event ticket bookings
if you contact us with a query or for more information via a ‘Contact us’ form
if you wish to sign up to our Consumer newsletter
if you order a brochure
if you telephone us, we will log your information in our Destination Management System

To periodically send you communications, which you have requested, and that may be of interest to you. These may include information about our associated companies goods and services, campaigns activities, and promotions.

What personal data we collect

The personal information we collect might include your name, address, email address, IP address, and information regarding what website pages are accessed and when.

When you book accommodation, buy attraction/event tickets or order items from our online shop, our order form asks you to give us information specific to that order, including your billing address, shipping address, credit card information and email address. The information that you provide is processed for the purpose of supplying the purchased goods and services and keeping proper records of those transactions. We also use the information to contact you if there is a problem with your order. All of our transactions automatically take place on a secure server. All of your personal information is encrypted before it is transmitted over the Internet.

For further details about how we define personal data and non-personal data please see our Data Protection Policy.

We may monitor and record electronic communications (website, email and phone conversations) for a number of reasons such as:

staff training
records of conversations
the detection, investigation and prevention of crime

We will inform you if your call is being recorded or monitored.

Emails that we send to you or you send to us, may be retained as a record of contact and your email address stored for future use in accordance with our retention periods. If we need to email sensitive or confidential information to you, we may perform checks to verify the correct email address and may take additional security measures.

How we use your personal data

We'll only use your personal data in accordance with data protection legislation, and for the purposes stated in this privacy notice.

We'll:

only ask for what is necessary for the purposes of dealing with your request or enquiry
protect it and make sure nobody has access to it who shouldn’t
ensure you know if you have a choice about giving us personal data
only share your personal data with other North Yorkshire Council departments or with external partners, agencies and contractors involved in delivering services on our behalf, eg, brochure distribution companies.
make sure we don’t keep it for longer than is necessary
delete or destroy it securely when we no longer have a need to keep it

We ask that you:

give us accurate information
tell us as soon as possible of any changes
tell us as soon as possible if you notice mistakes in the information we hold about you

From time to time, we may conduct or ask you to take part in a survey to get your feedback, comments and opinions to help us improve our services.

Marketing - your choices

We would like to send you information about our products and services which may be of interest to you. You have a choice about whether or not you wish to receive information from us and we will not contact you for marketing purposes by email, phone or text message unless you have given your prior consent. We will not contact you for marketing purposes by post if you have indicated that you do not wish to be contacted.

If you have previously agreed to us using your personal information for direct marketing purposes, you may change your mind (opt-out) at any time. You can also change your marketing preferences at any time by contacting us by writing to or emailing us.

When you buy from us online, our system automatically gathers purchase data, and we also record information about purchases made through our telemarketing, mail order and other marketing operations.

We use this information in two ways: We review what kinds of products and services appeal most to our visitors as a group. This statistical information helps us improve our offerings in the same way that other companies change their catalogue based on what sells best. We use information such as the number of purchases visitors make and the categories of goods and services they buy to make offers to them we believe will be of interest. We do not give out any information about you, as an individual, to anyone, except to complete your transactions, or to comply with valid legal process such as a search warrant, subpoena or court order.

Who we share your personal data with

Any information we use in presentations or reports will be anonymised and will not identify any individuals. For example a report on the numbers of accommodation bookings made will not feature any of your personal data.

We do not disclose or share sensitive or confidential information without your explicit consent except where disclosure is required by law, or where we have good reason to believe that failing to do so, would put you or someone else at risk.

We may be required or permitted, under data protection legislation, to disclose your personal data without your explicit consent, for example if we have a legal obligation to do so, such as for:

law enforcement
fraud investigations
regulation and licensing
criminal prosecutions
court proceedings

We must protect public funds and may use personal data and data-matching techniques to detect and prevent fraud, collect taxes and ensure public money is targeted and spent in the most appropriate and cost-effective way. To do this, your personal data may be shared with other bodies responsible for auditing or administering public funds, including the Department for Work and Pensions, HM Revenue and Customs, the Police and other local authorities.

Our legal basis for collecting and sharing personal data

There are a number of legal reasons why we need to collect and use your personal information. For this service:

6.1 (a) – Consent: you have given your consent. For example, you have signed up to receive marketing information from us.

6.1 (b) Contract: you have entered into a contract with us. For example, accommodation and theatre bookings.

How long we keep your personal data

We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting or reporting requirements. We will keep your personal data as set out in our Retention Policy. We will delete or destroy your personal data securely.

At the end of the retention period, we may pass any relevant information to the Archives where it is required or appropriate to do so.

Further processing of your personal data

If we wish to use your personal data for a new purpose, not covered by this Privacy Notice, then we'll provide you with a new notice.

The new notice will:

explain this new use before we start the processing
set out the relevant purposes and processing conditions

Where and whenever necessary, we'll seek your consent to the new processing, if we start to use your personal data for a purpose not mentioned in this Privacy Notice.

Social media

If you use any of our social network pages or applications or you use one of our products or services that allow interaction with social networks, we may receive information relating to your social network accounts. For instance:

if you click on a ‘like’, ‘+1’ or ‘tweet’ or similar button in one of our websites or services, we may record the fact that you have done so. In addition, the content that you are viewing may be posted to your social network profile or feed. We may receive information about further interactions with this posted content (for example, if your contacts click on a link in the posted content), which we may associate with the details that we store about you
if you ‘like’, ‘+1’ or similar one of our pages on a social network site, we may receive information about your social network profile, depending on your social network account privacy settings.

For more information and for details about how you can control access to your social network profile, you should view the privacy policy and other guidance available on your social network’s website.

Reviews, comments and content

Where you have uploaded product reviews, comments or content to our websites or services and made them publicly visible, we may link to, publish or publicise these materials elsewhere including in our own advertisements.

Forums

Each time you create or reply to a post or thread on a website forum from us, in addition to providing this forum service, we may also record the forum name and the time and date of your post or thread with your account details. We do this to better understand the ‘typical users’ of our forums and to select or tailor our marketing communications to reflect your forum activity. We do not use the actual content of your forum posts or threads for purposes of sending marketing communications.

Links to third party sites

Some of our websites may contain links to other third party websites that are not operated by us. Whilst we try to link only to sites that share our high standards and respect for privacy, we are not responsible for the content, security or privacy practices of those third party websites. We strongly encourage you to view the privacy and cookie policies displayed on those third party websites to find out how your personal information may be used.

Cookies

By using our website and agreeing to this policy, you consent to our use of cookies in accordance with our cookie policy which is available on our website

Your rights relating to your personal data

When we collect your personal data we'll tell you how we are going to use it. Where we process your personal data, you have a number of rights under data protection law.

To find out about your rights under data protection law, you can go to the Information Commissioners Office (ICO)

You can also find information about your rights

What if I have a concern or complaint?

If you have any questions, want to exercise your rights, or if you have a complaint about how your information has been used, please contact us at dataprotection@northyorks.gov.uk or on 01723 232323 or write to:

Data Protection Officer

County Hall, Racecourse Ln, Northallerton DL7 8AD