Privacy Policy

Updated on the 26th February 2024

Next review by the 26th February 2027

 

Who We Are

Chesham Town Council is the most local tier of government in Chesham. As well as providing services such as allotments, parks, play areas and other open spaces, we also run The Elgiva theatre and cinema, and Chesham Moor Gym and Swim. Please visit their web sites to view the privacy notices for these two centres. This privacy notice informs you of our privacy practices and of the choices you can make about the way we hold information about you as a website visitor and generally as part of our business. We have separate privacy notices that cover employees and other parties. We are committed to complying with the GDPR (2016), the UK GDPR (2021) and the Data Protection Act (2018) and good business practices. We are both a data controller and a data processor.

We take your privacy seriously, and this notice describes how we collect, store and use information you chose to share with us.

Links to Other Web Sites

Our web site may contain links to other web sites of interest. However, once you have used these links to leave our site, you should note that we do not have any control over that other website. Therefore, we cannot be responsible for the protection and privacy of any information which you provide whilst visiting such sites and such sites are not governed by this privacy notice.

You should exercise caution and look at the privacy statement applicable to the website in question.

Respecting Your Privacy

We are committed to ensuring that your privacy is protected. When you provide us with information, it will only be used in accordance with our Data Protection Policy and the relevant Privacy Notice. We regularly conduct data flows and a data inventory or data audit which looks at all aspects of the personal data that we process, including the legal basis for processing and any special requirements that the data needs. Any risk assessments (DPIAs) requirements are identified and completed paying particular attention to privacy risks associated with each processing activity: storage, collection, transmission, access and deletion. We will always process your data in a fair and lawful way in accordance with article 5 and article 6 of the GDPR.

We regularly complete Legitimate Interest Assessments to ensure that our marketing activities are considered, appropriate and are in accordance with all relevant legislation.

We will never knowingly collect data from or on children below 13 years old.

About This Notice

If you have any enquiries related to how we use your personal information or any particular aspects of our privacy notice you can contact us in writing to, Chesham Town Council, Chesham, Buckinghamshire, HP5 1DS or you can email [email protected].

Information We Collect and Process

When you visit our website we collect standard internet log information that helps us to analyse details, such as number of visitors to the site and patterns in visitor behaviour, which enable us to improve the user experience. We collect this information in a way that does not identify anyone.

The amount and type of information we record and process depends upon your relationship with us. We provide a wide variety of services, including allotments, room hires at the Town Hall, public meetings, Chesham Cemetery, our town donations scheme, the Local Produce Market, responding to public enquiries and running events.

Each form where we collect personal information will contain a specific privacy notice that explains to you why we are collecting your data and how long we will hold it for.
We outline below the different circumstances in which we collect data:

• We collect and process personal information provided by people when they contact us to enquire about our services because it is necessary before entering into a contract with us.
• We also collect and process personal information provided by people in the performance of public tasks, including running our allotments and cemetery services, and issuing Dangerous Vegetation notices.
• In other cases, we collect and process personal information provided by people because it is necessary for the pursuit of our legitimate interests, including:- The organisation of public events and meetings, such as Volunteer Chesham and Christmas in Chesham
  – Acting as data processor to provide administrative support for community groups
  – Operating our Town Partners scheme
  – Developing a Neighbourhood Plan
  – Administration of Mayoral activities and events
  – Dash Cams and in-fleet-vehicle cameras and trackers for safe fleet driving

In other cases, we will specifically ask for your consent to process your information at the time that we collect it.

Data Storage Location

We will not transfer your personal information outside of the EU without ensuring the correct data protection is in place.

Your Rights

The GDPR provides the following rights for individuals:

Rights What does this mean?

1. The right to be informed
   You have the right to be provided with clear, transparent and easily understandable information about how we use your information and your rights. This is why we are providing you with the information in this Privacy Policy.
2. The right of access
   You have the right to obtain access to your information. This is so you are aware and can check that we are using your information in accordance with data protection law.
3. The right to rectification
   You are entitled to have your information corrected if it is inaccurate or incomplete.
4. The right to erasure
   This is also known as the right to be forgotten and, in simple terms, enables you to request the deletion or removal of your information where there is no compelling reason for us to keep using it. This is not a general right, there are exceptions such as when data is used for a public task.
5. The right to restrict processing
   You have rights to block or suppress further use of your information. When processing is restricted, we can still store your information, but may not use it further. We keep lists of people who have asked for further use of their information to be blocked to make sure the restriction is respected in future.
6. The right to data portability
   You have rights to obtain and reuse your personal data for your own purposes across different services. This is not a normal scenario for companies of our nature but if you have any questions you can contact us.
7. The right to object to processing
   You have the right to object to certain types of automated processing or decision making, including processing for direct marketing or where we are relying on our legitimate interests for processing.
8. The right to withdraw consent
   If you have given your consent to anything we do with your personal data, you have the right to withdraw your consent at any time (although if you do so, it does not mean that anything we have done with your personal data with your consent up to that point is unlawful). This includes your right to withdraw consent to us using your personal data for marketing purposes

Specific Events and Projects

Neighbourhood Plan Consultation

When consulting with residents and local businesses about the development of the Chesham Neighbourhood Plan, we will give you the choice to provide us with your name, postal address and email address. If you provide us with this information, we will retain it securely and use it only to provide you with updates on the Neighbourhood Plan. We will securely destroy this information once it is no longer required. You have the right to withdraw consent at any time, by emailing [email protected] or writing to, Chesham Town Hall, Chesham. HP5 1DS.

Christmas Day Party

If you are a guest, we will process your information because it is necessary for the pursuit of our legitimate interest to organise the Christmas Day Party. We need your personal data and sensitive personal data to provide services for this event such as transportation, to comply with dietary and personal situation requirements and to get hold of emergency contacts in the event of a problem on the day. This information is kept securely and will only be disclosed to individuals who need to know such as drivers and allocated carers, who may be volunteers for this specific event. As soon as this event is over, the special category data and emergency contact details will be deleted in accordance with Chesham Town Council’s data retention policy. Guest contact details only will be retained to invite guests the following year.

Sharing Information With Other Organisations and Companies

We will not sell, distribute, or lease your personal information to third parties unless we have your consent or are required by law to do so. Please note that we do not require your consent to share this information if we suspect criminal or unlawful activity, in these circumstances we will only contact the relevant organisations.

We do act as a data processor for several voluntary organisations, and they may choose to share personal information with us to enable us to provide them with administrative support.

We use third parties in conjunction with routine business requirements, accountancy and insurance services.

• With professional advisors such as accountants and insurance, although this information will be very limited;
•  In order to conduct checks on you to verify the information you have provided us with where you are being considered for a position or contract with us;
•  With suppliers but only subject to robust contractual protections;
•  If we are legally obliged to do so.

Photography

We may take people’s photos for publicity purposes. With the exception of general crowd scenes, we will obtain written consent for the use of these photographs and explain how they may be used when obtaining consent. Parental consent will be obtained for subjects under the age of 18. You will be asked to provide your name and signature, and if giving consent for a minor, the name of the child. You have the right to withdraw consent at any time, by emailing [email protected] or writing to, Chesham Town Hall, Chesham. HP5 1DS. Please note, it is not possible for the council to control or withdraw materials that have already been published.

We are not responsible for any photography that is beyond the scope of our control.

Use of Our Website

The following aspects of your privacy are related specifically to use of our website: www.chesham.gov.uk

Contact Us Form

If you submit an enquiry via our website, you are asked to provide your name and email address. This information is stored within a database used to run the website and is deleted once your enquiry with us has been concluded.

Our website uses cookies for the following purposes:

•  Tailoring the website to you as an individual by remembering your preferences.
•  Monitoring website traffic and identifying which pages are being used. This allows us to improve our website by better understanding how it is used.

We use third party cookies from Google to enable us to use Google Analytics. Google acts as a data processor for us and may store the information collected by the cookie on servers in the United States. Google is certified under the EU – U.S. framework, which is a legal mechanism to enable the transfer of personal data from the EEA to the US, where certified organisations guarantee to provide a level of protection in line with EU data protection law. By using the website, you consent to the processing of data about you by Google in the manner and for the purposes set out above.

Overall, cookies help us provide you with a better website. A cookie in no way gives us access to your computer or any information about you, other than the data you choose to share with us.

You can choose to accept or decline cookies. Most web browsers automatically accept cookies, but you can usually modify your browser setting to decline cookies if you prefer. This may prevent you from taking full advantage of the website.

Category	Cookie Name	Purpose
Google Analytics	_ga,_ga_Q1DGPS0DVW,_gat_gtag_UA_22241355_1,_gid	Used to see how our website users navigate the site
Necessary Cookies	PHPSESSID	Necessary cookies enable core functionality. The website cannot function properly without these cookies, and can only be disabled by changing your browser preferences.
Necessary Cookies	aubergine_cookie_consent	Necessary cookies enable core functionality. The website cannot function properly without these cookies, and can only be disabled by changing your browser preferences.
Necessary Cookies	close_site_notice	Necessary cookies enable core functionality. The website cannot function properly without these cookies, and can only be disabled by changing your browser preferences.
Necessary Cookies	_GRECAPTCHA	Necessary cookies enable core functionality. The website cannot function properly without these cookies, and can only be disabled by changing your browser preferences.

Our website is provided by Aubergine, which is based in the UK. Their web server logs basic details of the web browser, IP address and operating system of users visiting our website. The web logs are kept on Aubergines’ servers for two years.

Controlling Your Personal Information

Whenever you provide us with personal information, we will use the details you provide in reference to that specific enquiry or sales transaction.

Data Subject Access Requests

You have the right to request a copy of any personal information which we hold about you. We may need to confirm your identity before any information is released to you. We will try and verify your identity using personal data that we already have but may require other forms of identification or permission details if you are requesting the information on behalf of another data subject. We can extend this response time to three months if the request is complex and involves other data subjects. If we need more time, we will advise you.

We will respond within one month, giving you a copy of your data, why we have it, who it could be disclosed to, the categories of data it involves, and it will be in a format that you can access easily. You have the right to clarify and correct the information as necessary. It can be deleted provided that it is not required for legal or public interest reasons. If your request is more complex, for example it involves other data subjects and we need their consent to release the relevant information we can extend our response time to three months, but we will inform you of this. If theydo not give their consent, we will anonymise this data or remove the relevant detail before sending this to you. We will not charge for data subject access requests unless they are excessive or manifestly unfounded. Then we will charge for administrative time only.

If you would like a copy of the information we hold about you, contact us by post, Chesham Town Council, Chesham, Buckinghamshire, HP5 1DS or you can email [email protected].

Retention of Information

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. Our data retention policy considers the amount of data, its nature and sensitivity, the potential risk of harm from unauthorised use or disclosure, the processing purposes and if these can be achieved by other means and legal requirements.

In some circumstances we may anonymise your personal data for research or statistical purposes in which case we may use this information indefinitely without further notice to you. You will not be recognisable as a natural living person from this anonymised data.

Security

We are committed to ensuring that your information is secure. In order to prevent unauthorised access or disclosure, we have physical, electronic and managerial procedures to safeguard and secure the information we collect and process, both online and in person.

All data we retain is protected in accordance with best industry practice, including password protection, data encryption and firewalls.

If – despite our security measures and safeguards – we detect a security breach, we have procedures in place to deal with any suspected personal data breach and will notify you and any supervisory body of a breach if we are legally required to.

Concerns, Comments and Feedback

If you have any concerns about your data, or any comments or feedback about our services then please get in touch and we will do our best to help you: [email protected]

If you have any concerns about how your data is being used or processed and we have not been able to help you, then you can contact the ICO. Ways to report concerns are detailed on their website: https://ico.org.uk/concerns/