Privacy Policy

Who We Are

Chesham Town Council is the most local tier of government in Chesham. As well as providing services such as allotments, parks, play areas and other open spaces, we also run The Elgiva theatre and cinema, and Chesham Moor Gym and Swim. Please visit their web sites to view the privacy policies for these two centres.

We take your privacy seriously, and this notice describes how we collect, store and use information you chose to share with us.


Respecting Your Privacy

We are committed to ensuring that your privacy is protected. When you provide us with information, it will only be used in accordance with our Data Protection Policy and the relevant Privacy Notice.


About This Policy

If you have any enquiries related to how we use your personal information or any particular aspects of our privacy policy you can contact us in writing to Kathryn Graves, Chesham Town Council, Chesham, Buckinghamshire, HP5 1DS or you can email

We may change our privacy policy occasionally. You should check this page from time to time to ensure that you are happy with any changes. The current version of this privacy policy is effective from 8th December 2021.


Information We Collect and Process

The amount and type of information we record and process depends upon your relationship with us. We provide a wide variety of services, including allotments, room hires at the Town Hall, public meetings, Chesham Cemetery, our town donations scheme, the Local Produce Market, responding to public enquiries and running events.

Each form where we collect personal information will contain a specific privacy notice that explains to you why we are collecting your data and how long we will hold it for. We outline below the different circumstances in which we collect data:

We collect and process personal information provided by people when they contact us to enquire about our services because it is necessary before entering into a contract with us.

We also collect and process personal information provided by people in the performance of public tasks, including running our allotments and cemetery services, and issuing Dangerous Vegetation notices.

In other cases, we collect and process personal information provided by people because it is necessary for the pursuit of our legitimate interests, including:

  • The organisation of public events and meetings, such as Volunteer Chesham amd Christmas in Chesham
  • Acting as data processor to provide administrative support for community groups
  • Operating our Town Partners scheme
  • Developing a Neighbourhood Plan
  • Administration of Mayoral activities and events
  • Dash Cams and in-fleet-vehicle cameras and trackers for safe fleet driving

In other cases, we will specifically ask for your consent to process your information at the time that we collect it.


We may take people's photos for publicity purposes. With the exception of general crowd scenes, we will obtain written consent for the use of these photographs and explain how they may be used when obtaining consent. Parental consent will be obtained for subjects under the age of 18. You will be asked to provide your name and signature, and if giving consent for a minor, the name of the child.  You have the right to withdraw consent at any time, by emailing or writing to Kathryn Graves, Chesham Town Hall, Chesham. HP5 1DS. Please note, it is not possible for the council to control or withdraw materials that have already been published. 

Neighbourhood Plan Consultation

When consulting with residents and local businesses about the development of the Chesham Neighbourhood Plan, we will give you the choice to provide us with your name, postal address and email address. If you provide us with this information, we will retain it securely and use it only to provide you with updates on the Neighbourhood Plan. We will securely destroy this information once it is no longer required. You have the right to withdraw consent at any time, by emailing or writing to Kathryn Graves, Chesham Town Hall, Chesham. HP5 1DS. If you have answered our survey online, please also check the Privacy Policy of the survey provider,

Christmas Day Party

If you are a guest, we will process your information because it is necessary for the pursuit of our legitimate interest to organise the Christmas Day Party. We need your personal data and sensitive personal data to provide services for this event such as transportation, to comply with dietary and personal situation requirements and to get hold of emergency contacts in the event of a problem on the day.  This information is kept securely and will only be disclosed to individuals who need to know such as drivers and allocated carers, who may be volunteers for this specific event.  As soon as this event is over, the special category data and emergency contact details will be deleted in accordance with Chesham Town Council’s data retention policy.  Guest contact details only will be retained to invite guests the following year. 

COVID-19 Test and Trace

To support NHS Test and Trace (which is part of the Department for Health and Social Care) in England, DHSC has provided guidance which we have chosen to follow. The guidance recommends that we collect and keep a limited record of staff, customers and visitors who come onto our premises for the purpose of contact tracing.

By maintaining records of staff, customers and visitors, and sharing these with NHS Test and Trace where requested, we can help to identify people who may have been exposed to coronavirus.

As a visitor to the Town Hall, you might be asked to provide some basic information and contact details. The following information will be collected:

  • the names of all visitors
  • a contact phone number for each customer or visitor
  • date of visit

As the data controllers for the collection of your personal data, we will be responsible for compliance with data protection legislation for the period of time we hold the information. If that information is requested by the NHS Test and Trace service, the service would at this point be responsible for compliance with data protection legislation for that period of time. NHS Test and Trace as part of safeguarding your personal data, has in place technical, organisational and administrative security measures to protect your personal information that it receives from the venue or establishment, that it holds from loss, misuse, and unauthorised access, disclosure, alteration and destruction.

NHS Test and Trace as part of its guidance, has recommended that we retain this information for 21 days from the date of your visit, to enable contact tracing to be carried out by NHS Test and Trace during that period. We will only share information with NHS Test and Trace if it is specifically requested by them. For example, if other visitors at the venue subsequently tested positive, NHS Test and Trace can request the log of customer, visitor and staff details on a particular day.

Under government guidance, the information we collect may include information which we would not ordinarily collect from you and which we therefore collect only for the purpose of contact tracing. Information of this type will not be used for other purposes, and NHS Test and Trace will not disclose this information to any third party unless required to do so by law (for example, as a result of receiving a court order). In addition, where the information is only collected for the purpose of contact tracing it will be destroyed by us 21 days after the date of your visit.

However, the government guidance may also cover information that we would usually collect and hold onto as part of our ordinary dealings with you (perhaps, for example, your name and phone number). Where this is the case, this information only will continue to be held after 21 days and we will use it as we usually would, unless and until you tell us not to.

Your information will always be stored and used in compliance with the relevant data protection legislation. The use of your information is covered by the UK General Data Protection Regulations Article 6 (1) (f) – legitimate interests of the venue or establishment. The legitimate interest in this case is the interest of the venue/establishment in co-operating with NHS Test and Trace in order to help maintain a safe operating environment and to help fight any local outbreak of coronavirus.

Collection of information from or about children under the age of 18 requires the consent of their parent or guardian.

Sharing Information With Other Organisations and Companies

We will not sell, distribute or lease your personal information to third parties unless we have your consent or are required by law to do so.  Unless you have opted out, if we have collected your contact details under the Test and Trace programme, we will share your information with NHS Test and Trace if they ask us to do so. 

We do act as a data processor for a number of voluntary organisations, and they may choose to share personal information with us to enable us to provide them with administrative support.

Under the Local Authorities and Police and Crime Panels (Coronavirus) (Flexibility of Local Authority and Police and Crime Panel Meetings) (England and Wales) Regulations 2020 Council and Committee meetings until May 2021 could be held remotely and recorded via Microsoft Teams. All participants were advised if the meeting wa being recorded. Only authorised council members and officers can view these recordings, which are deleted after a time period specified in our Policy on Filming, Recording and Reporting on Council Meetings. For more information, please view Microsoft's Privacy Policy


Use of Our Website

The following aspects of your privacy are related specifically to use of our web site:


Contact Us Form

If you submit an enquiry via our web site, you are asked to provide your name and email address. This information is stored within a database used to run the web site and is deleted once your enquiry with us has been concluded.



Our website uses a technology called cookies for the following purposes:

  • Tailoring the web site to you as an individual by remembering your preferences.
  • Monitoring web site traffic and identifying which pages are being used. This allows us to improve our web site by better understanding how it is used.

We use third party cookies from Google to enable us to use Google Analytics. Google acts as a data processor for us and may store the information collected by the cookie on servers in the United States. Google is certified under the EU - U.S. framework, which is a legal mechanism to enable the transfer of personal data from the EEA to the US, where certified organisations guarantee to provide a level of protection in line with EU data protection law. By using the web site, you consent to the processing of data about you by Google in the manner and for the purposes set out above.

Overall, cookies help us provide you with a better web site. A cookie in no way gives us access to your computer or any information about you, other than the data you choose to share with us.

You can choose to accept or decline cookies. Most web browsers automatically accept cookies, but you can usually modify your browser setting to decline cookies if you prefer. This may prevent you from taking full advantage of the web site.

Our web site is provided by E-Mango, which is based in the UK. Their web server logs basic details of the web browser, IP address and operating system of users visiting our web site. The web logs are kept on E-Mango’s servers for two years.


Links to Other Web Sites

Our web site may contain links to other web sites of interest. However, once you have used these links to leave our site, you should note that we do not have any control over that other web site. Therefore, we cannot be responsible for the protection and privacy of any information which you provide whilst visiting such sites and such sites are not governed by this privacy notice.

You should exercise caution and look at the privacy statement applicable to the web site in question.


Controlling Your Personal Information

Whenever you provide us with personal information we will use the details you provide in reference to that specific enquiry or sales transaction.


Information Requests

You have the right to request a copy of any personal information which we hold about you. We will respond to any such requests within one month.

Requesting a copy of your information is generally free of charge, although we reserve the right to charge for requests which are manifestly unfounded, excessive or repetitive.

If you would like a copy of the information we hold about you, contact us by post to Kathryn Graves, Chesham Town Council, Chesham, Buckinghamshire, HP5 1DS or you can email


Retention of Information

The length of time for which we retain your information will depend on the reason why we are processing your data. Individual policy notices are contained within forms, so that you can read about the retention period for the data at the point that you are providing us with the information. In relation to the Communi-Tree Project, if you are volunteering for tree planting, your data  will be destroyed within 3 months of the tree planting. If you are volunteering for watering, we will hold your data for 2 years. 


Your Right to be Forgotten

You have the right to request erasure of your personal data. This is also known as the right to be forgotten. However, this right does not apply in all cases, such as when the data is being processed for a public task.

You may request that we delete your personal information either verbally or in writing and we will respond within one month.


Accuracy of Information

We want to keep your information up to date. If you believe that any information we have about you is incorrect or incomplete, please write to or email us as soon as possible. We will promptly correct any information found to be incorrect.



We are committed to ensuring that your information is secure. In order to prevent unauthorised access or disclosure, we have physical, electronic and managerial procedures to safeguard and secure the information we collect and process, both online and in person.

If - despite our security measures and safeguards - we detect a security breach, we will immediately assess the potential impact on the personal data we store and take the appropriate action



In the unlikely event that we are unable to handle any requests or enquiries relating to your privacy to your satisfaction, you have the right to lodge a complaint with the Information Commissioner’s Office. Further information, including contact details, is available at