Stone Pavilion
Hayes Road
Greenhithe
Kent DA9 9DS
T: 01322 384400
Privacy Notice
What Personal Data We Collect
Depending on your interaction with the Council, we may collect:
- Name
- Postal address
- Email address
- Telephone number
- Organisation details
- Information relating to your enquiry, service request or complaint
- Payment information (for hall hire, services, etc.)
- CCTV images (where applicable)
- Information needed for event participation or bookings
- Correspondence and supporting documents you provide
- Any other information necessary for delivering council services or complying with legal duties
We do not knowingly collect information from children under 13 without parental consent.
Why We Collect Your Data (Purposes of Processing)
We process personal data to:
- Respond to enquiries, requests, and correspondence
- Provide services, facilities, and bookings
- Deliver statutory and public functions
- Maintain accurate records
- Process financial transactions
- Administer events and community activities
- Manage complaints and feedback
- Meet legal and regulatory obligations
- Ensure the safety and security of our staff, visitors and property
- Contact you about matters relating to Council services
We will only collect the minimum amount of information necessary for each purpose.
Lawful Bases for Processing
We process personal data under the following lawful bases in Article 6 of the UK GDPR:
Public Task – Article 6(1)(e)
Most Council activities are carried out as part of our statutory public functions. Processing is necessary for performing a task in the public interest or in the exercise of official authority.
Legal Obligation – Article 6(1)(c)
We may process data where required by law, such as financial regulations, community governance, transparency requirements, or health and safety legislation.
Contract – Article 6(1)(b)
Where you enter into a contract with us (e.g., hall hire, bookings, tenancy agreements).
Consent – Article 6(1)(a)
Where consent is required (e.g., mailing lists), you may withdraw it at any time.
Vital Interests – Article 6(1)(d)
Rarely, we may use personal data to protect someone’s life.
We will always tell you which lawful basis applies in a given situation.
Who We Share Your Information With
The Council does not sell personal data to third parties.
We may share information where necessary with:
- Service providers, contractors or suppliers working on behalf of the Council
- IT and system providers (e.g., email, web, secure data storage)
- Professional advisors (e.g., legal, HR, health & safety)
- External or internal auditors
- Insurers
- Government agencies or regulators where legally required
- Law enforcement bodies where necessary for the prevention or detection of crime
All third parties are required to handle your data securely and in accordance with UK GDPR.
How We Store and Protect Your Information
We take appropriate technical and organisational measures to protect personal data from:
- unauthorised access
- loss
- alteration
- misuse
- disclosure
These measures include secure systems, password protection, restricted access, encryption where appropriate, and staff training.
How Long We Keep Your Information
We retain personal data only for as long as necessary for the purpose for which it was collected, after which it is securely deleted or anonymised.
Retention periods are set out in the Council’s Records Retention Schedule, available on request.
Your Rights Under Data Protection Law
You have the following rights:
Right of Access
To request a copy of the personal data we hold about you.
Right to Rectification
To have inaccurate or incomplete information corrected.
Right to Erasure
To request deletion of your data when legally permitted
(Note: this right does not normally apply to data processed under Public Task or Legal Obligation.)
Right to Restrict Processing
To limit how your data is used in certain circumstances.
Right to Object
To object to processing based on public task or legitimate interests.
Right to Data Portability
Applies only to data processed under consent or contract via automated means.
Rights related to automated decision making
The Council does not use personal data for automated decision-making or profiling.
You may exercise these rights by contacting the Town Clerk.
Children’s Data
We do not process personal data relating to children under 13 without parental or guardian consent unless a legal basis applies.
Transfers Outside the UK
If any personal data is stored or processed outside the UK (for example by email or cloud providers), we ensure that adequate safeguards are in place, such as:
- adequacy decisions, or
- standard contractual clauses (SCCs)
Complaints
If you have concerns about how your personal data has been handled, please contact:
Stone Town Council: e: clerk@stone-tc.gov.uk
t: 01322 384400 and the Information Commissioners Office casework@ico.org.uk Tel: 0303 123 1113