Privacy Notice - Part 1
About this privacy notice
We are committed to protecting the privacy of all those individuals whose personal information we process. This privacy notice explains how we collect, manage, and use personal information and is set out in two parts:
-
Part 1 sets out certain general matters relating to the Authority and its collection, management, and use of your personal information, and your individual rights relating to your personal information.
-
Part 2 sets out specific matters according to the nature of our relationship with you, including the type of personal information that we may process, our lawful basis for processing your personal information (and any special conditions relied upon), and how we may share your personal information with third parties. You can view Part 2 using the links provided here.
Part 2 - Employees
Organisation details
Your personal information
Personal information is information that is about you or that otherwise concerns you, from which you can be identified, either directly or indirectly in combination with other information. We need to collect and use personal information to fulfil our functions, provide services, and operate effectively. Depending on our relationship with you, we are either the controller or the processor of your personal information.
If you are under 16
We do not knowingly or specifically collect information about children under the age of 16 otherwise than as set out in Part 2 of this Privacy Notice (Photographs, Videos and Written Stories). If you are under 16 and are worried about how we are using information about you, then you or someone you trust can contact us for help: crm@leevalleypark.org.uk.
Lawful basis
We will only process your personal information where we have identified a lawful basis to do so, pursuant to a special condition as set out in Article 6 of the UK General Data Protection Regulation (UK GDPR). The lawful bases we may rely on are as follows:
Further information about this is also available on the Information Commissioner’s website.
Special category information
We may process your special category information, such as:
-
Racial or ethnic origin
-
Political opinions
-
Religious or philosophical beliefs
-
Trade union membership
-
Genetics and biometrics (where used for identification purposes)
-
Health and disabilities
-
Sex life
-
Sexual orientation
Where we process this information, it will only be for legitimate Authority business purposes and pursuant to a special condition as set out in Article 9 of the UK General Data Protection Regulation (UK GDPR) and Schedule 1 of the Data Protection Act 2018 (DPA). See ‘special conditions’ section below for more information.
Criminal record and offences information
We may process your criminal records and offences information. Where we do, it will only be for legitimate Authority business purposes and pursuant to a special condition as set out in Article 10 of the UK General Data Protection Regulation (UK GDPR) and Schedule 2 of the Data Protection Act 2018 (DPA). See ‘special conditions’ section below for more information.
Special conditions
The special conditions relied upon for processing special category and criminal convictions and offences information are as follows:
-
Explicit consent
-
Employment, social security, and social protection authorised by law
-
Vital interests
-
Made public by the data subject
-
Legal claims or judicial acts
-
Reasons of substantial public interest with a basis in law
-
Health or social care with a basis in law
-
Public health with a basis in law
-
Archiving, research, and statistics with a basis in law
Part 2 of this privacy notice provides further information about the special conditions applicable to the processing of special category information and information relating to criminal convictions and offences. Further information about special conditions is also available on the Information Commissioner’s website.
Where your information will be stored
Your personal information will be stored in a range of different places in the Authority’s information management systems, including email and paper records. Further information is given in Part 2 of this privacy notice.
Security of your information
We operate technical and organisational measures to ensure the security of all personal information that we hold and to prevent it from being accidentally lost, or used, accessed, altered or disclosed in an unauthorised way. We review these measures regularly to make sure they remain appropriate to the type of data and method of processing. Your information is stored in a secure environment and is only accessible by authorised personnel who have a legitimate reason to do so. We have also put in place procedures to deal with any suspected personal information breach and will notify you and any applicable regulator of a breach where we are legally required to do so.
Separately, you also need to take precautions to protect your personal information when you use the internet.
We cannot guarantee the security of any private information provided to us in an email or in online form while it is being transmitted to us, as the internet is a potentially non-secure method of information transfer. Any such transmission is at your own risk. If in the course of using the Authority’s websites you choose to upload or post private information on public areas of the site, such information is not considered personal information and will not be subject to this privacy notice.
Retention of your information
We will process your personal information for as long as it is required for the purposes for which it was collected. We may keep it longer where we are required to do so, for example by law or regulation or for legitimate business reasons. We review our processing of personal information on a regular basis and securely delete or destroy that information when it is no longer needed. Part 2 of this privacy notice provides further information.
To determine the appropriate retention period for your personal information, we consider the amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorised use or disclosure of your personal information, the purposes for which we process your personal information and whether we can achieve those purposes through other means, and the applicable legal requirements.
Details of retention periods for different aspects of your personal information are included in part 2 of this privacy notice. In some circumstances we may anonymise your personal information (so that it can no longer be associated with you) for research or statistical purposes in which case we may use this information indefinitely without further notice to you.
Each email sent by the Authority using our email marketing solution provides a clear unsubscribe link which will immediately remove you from any or all of our mailings as you specify.
Sharing your personal information
We may share your personal information, either internally within the Authority or externally with our partners or other organisations for legitimate purposes.
We will only share your personal information with a third party where it is lawful to do so under the UK GDPR and the DPA, for example where there is a lawful basis (and where applicable a special condition), or where there is an exemption provided by the DPA. We also ensure that the recipient has measures in place to use and protect the information in line with UK GDPR requirements, as may be set out in contractual clauses or data sharing agreements. Part 2 of this privacy notice provides further information about third parties with whom we may share your personal information, but they may include:
International transfer of personal information
We do not transfer your personal information outside the European Economic Area. Where our service providers are based in the US, they may be permitted access to our servers. Those service providers are part of the Privacy Shield which requires them to provide similar protection to personal information shared between Europe and the US. For further details, please see European Commission: EU-U.S. Privacy Shield Framework.
Automated decision making
We do not carry out any activities using automated decision making.
Location data
Our websites use your location data to provide you with more relevant content specific to your local area, however no automated decisions are made during this process. Part 2 of this privacy notice (Website Cookies) provides further information.
Contact preferences
Where appropriate, we will keep a record of your contact and communication preferences, to ensure that you maintain control over how we contact you, and that we only provide you with information in which you are interested. Depending on our relationship with you and our lawful basis for processing your personal information, you may not be able to opt out of certain communications, for example where they are vital to you as an employee or volunteer.
Direct marketing and promotion
We will only contact you for marketing and promotional purposes if you have either consented to receive this information (either by consenting directly to us or by giving your consent to another organisation which is organising an event at one of our venues) or if we think it is of interest to you based on previous services you have received from us, or if you provided us with your details when you entered a competition or registered for a promotion, and, in each case, you did not opt-out of receiving that marketing. You have a right to opt out of this marketing at any time by contacting the Authority crm@leevalleypark.org.uk.
Where you have given your consent to an event organiser providing us with your personal information for marketing and promotional purposes, in order for us to develop our services, we may share that information with an operator of our venues. Other than as described above, we will not share your personal information with any third party companies for marketing purposes unless you have explicitly consented for us to do so.
You can unsubscribe at any time via telephone, our websites or by clicking the unsubscribe link at the bottom of all email communications. You can also change your preferences by logging on to your My Lee Valley Page.
Legal matters
We may process your information to instigate or defend legal proceedings and may be required to share your information with legal authorities where this is required for the purpose of legitimate business, for example the police and HMRC. Part 2 of this privacy notice provides further information.
Your individual rights
The following are your individual information rights:
Please note that some of these rights are not automatic, and we may legitimately decline to action some requests depending on the circumstances. Further, exercising some of these rights could impact on our continued relationship with you and the provision of our services. Should either of these be the case, you will be given more details at the time.
Who to contact about your personal information
If you wish to exercise any of your data protection rights, or make an enquiry or complaint about how we have handled your personal information, please contact us by email, post or telephone. Our contact details are at the beginning of this notice. We also encourage you to let us know if your personal information changes, or if you think the personal information that we hold is wrong or out of date. We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.
If you wish to raise a complaint on how we have handled your personal information, you can contact our Data Protection Officer who will investigate the matter. Our Data Protection Officer is responsible for overseeing questions in relation to this privacy notice. Contact details are at the beginning of this privacy notice.
Making a complaint to the Information Commissioner’s Office
We encourage you to contact us before making a complaint, and we will seek to fully resolve any issues or concerns you may have. If you are not satisfied with our response to any query you raise with us, or you believe we are processing your personal information in a way which is inconsistent with the law or your data protection rights, you can complain to the Information Commissioner’s Office at www.ico.org.uk or by calling 0303 123 1113.
Changes and updates to this privacy notice
We may change this privacy notice (parts 1 and/or 2) from time to time without notice to you. Any changes will apply to you and your data immediately. If these changes significantly affect how your personal information is processed, we will take reasonable steps to let you know.
This privacy notice was last updated in January 2025.