We, Hull Culture and Leisure Limited, are registered as a Data Controller under the Data Protection Act 1998 and General Data Protection Regulation 2018 as we collect and process personal information about you. Our registration number is: ZA240301.
Visit the Information Commissioner Office website to access our data protection notification
Our Data Protection Officer (the person in our organisation responsible for ensuring we comply with our legal responsibilities) is -
Michelle Alford
Library Services Director
Hull Culture and Leisure Ltd
Pacific Exchange
40 High Street
HU1 1PS
Tel - 01482 614282
Email - michelle.alford@hcandl.co.uk
This notice explains how we collect, use and share your information to provide services to you.
How we collect your personal information
Personal information may be collected in the following ways -
- on paper
- electronic form
- customer account or online forms
- telephone
- website
- CCTV
- face to face (via our employees or partners)
Why we collect information about you
We need to collect and hold information about you to -
- deliver public services
- confirm your identity to provide some services
- contact you by post, email or telephone
- be aware of your needs to provide services that you request
- understand what we can do for you and inform you of other relevant services and benefits
- help us build up a picture of how we are performing at delivering services to you and how these services can be improved
- prevent and detect fraud and corruption through inappropriate use of public funds
- make sure we meet our statutory obligations including those related to equality and diversity, and health and safety
We will always be open and transparent with you about how we use your personal data and who it is shared with. If we do not have enough information, or your permission to use certain information, we may not be able to provide your requested service or product.
Your rights in relation to your data
The law on data protection gives you specific rights in relation to your data that we hold. These are -
- the right to be informed. This means that we must tell you how we use your data, and this is the purpose of this privacy notice
- the right of access. You have the right to access the data that we hold on you. To do so, you should make a Subject Access Request.
- the right for any inaccuracies to be corrected. If any data that we hold about you is incomplete or inaccurate, you can ask us to correct it
- the right to have information deleted. If you would like us to stop processing your data, you have the right to ask us to delete it from our systems, if we have no legal basis to continue to hold your data we must remove it from our systems
- the right to restrict the processing of the data. For example, if you believe the data we hold is incorrect, we will stop processing the data (whilst still holding it) until we have ensured that the data is correct
- the right to portability. You can obtain and reuse your personal data held by us by moving, copying or transferring your data from one IT environment to another in a secure way and without affecting its usability
- the right to object to the processing of your personal data. You have the right to object to the processing of your data if it is used for direct marketing or collected for a task carried out in the public interest, the exercise of official authority, or under legitimate interest
- the right to regulate any automated decision-making and profiling of personal data. We must tell you if we use automated decision-making and/or use your personal data for profiling and you have the right to object. There are strict guidelines we must follow if we use your personal data in this way
The personal data we collect
If you register for a customer account with one of our services, or to receive information from them, you might be asked for the following personal information so that we can provide that service or information to you -
- name
- address
- date of birth
- email address
- telephone number
- credit card details
- bank account details
- ethnicity
- gender
- disability
This personal information will only be used to process transactions and data for the purpose of providing you with the services you have registered for or to comply with our legal duty. We will be clear in our Privacy Notices what we will do with your data.
Lawful Basis
In order to process your personal information we have to have a lawful basis on which to do so, we will tell you what this is when we collect the information.
The only lawful bases we can use will be one of the following -
- consent
- contract
- legal obligation
- vital interests
- public task
- legitimate interests
Find out more on the Information Commissions Office website
How we use your information
We will conform to the Data Protection Act and General Data Protection Regulation and use your information to -
- undertake administrative processes to provide the service you requested
- process financial transactions including payments for services or grants involving the company
- provide a service, or process a financial transaction, where we are acting on behalf of other government bodies such as Hull City Council, the Department for Work and Pensions, or similar. If we are acting on behalf of a third party we will make this clear to you. When the third party collected your personal information they should have made it clear to you that we, Hull Culture and Leisure Ltd, will process your data on their behalf
- protect individuals from the risk of harm or injury, where necessary
- allow statistical analysis of data (that you cannot be personally identified from) so we can target and plan the provision of services
- to send you information about our services and events if you have asked us to
If you have any questions about how we use your personal details, email info@hcandl.co.uk.
You can also submit a subject access request if you require a copy of any data that involves you.
How we keep your information safe
We respect our responsibility to hold your personal information on your behalf and keep it safe by -
- only retaining it for as long as we need to
- checking that effective safeguards are in place
- making sure all employees handling your information have had appropriate training
- having processes in place to monitor, identify and deal with misuse by employees
- processing all personal data in accordance with the principles of the data protection act and General Data Protection Regulation
Hull Culture and Leisure Ltd maintains a register of all data collected and its retention period, please email info@hcandl.co.uk if you would like a copy of this register.
Who processes your information
Our Board of Directors and employees are only given access to your personal information for the specific purpose for which they are authorised. They may not disclose your personal data to anyone else without your consent unless they are legally obliged or empowered to do so.
If you make a complaint about company services your personal data may be shared with the Company’s board and employees working in the service concerned.
If you sign a petition that is presented to a Hull Culture and Leisure board or a council meeting your personal data may be shared with the board of directors, your local ward councillors, committee members and council employees working in the service concerned.
How we share your information
We may need to pass your information to partner organisations that provide the service you have requested on our behalf. These partners are obliged to keep your details secure through a contract, service level agreement or community charter and use them only to fulfil your request.
If we wish to pass your sensitive or confidential information onto a third party, we will only do so once we have obtained your consent, unless we are legally required to do so, or where we have good reason to believe that failing to share the information would put you or someone else at risk.
We may disclose information to other partners where it is necessary such as to comply with a legal obligation or where permitted under the Data Protection Act and GDPR. This includes the prevention and/or detection of crime.
We will only pass your personal information to external organisations for marketing or sales purposes or any commercial use with your prior consent.
We will only transfer your personal information overseas where we are obliged to do so by law. Also in certain cases where there is a specific requirement to do so (your consent will be obtained beforehand).
Right to data rectification
You have the right to have your data rectified where it is inaccurate or incomplete. You may use this form to request that your data be rectified.
Hull Culture and Leisure will respond to your request within one month and will take steps to restrict the use of your data whilst we verify whether the data is inaccurate. The following link tells you how you can do this.
Right to have your data erased
You have the right to request that we stop processing your personal data in relation to any of our services. This may cause delays or prevent us providing you with a service.
Your account will be closed within 28 days of the request although it may not always be possible to fulfil your request as it may be necessary to hold or process information to comply with a legal requirement, or where money is owed to us, or you have items on loan from us.
We will reply to you within 21 days and let you know what action we have taken with your request.
Web statistics
Our website(s) automatically logs information about your visit such as your browser type and the length of your visit. We use this information to understand how visitors interact with the site so we can make informed decisions about design improvements. Our website(s) does not collect any personal information about you.
Find out more information on how we use cookies on our website
Audit fraud data sharing
We are required by law to protect the public funds we administer. We may share information with other bodies responsible for auditing or administering public funds, in order to prevent and detect fraud.
Hull Culture and Leisure Accounts are audited each year by an external auditor and published by Company’s House. We will make a link to them available on our website.
As a Company wholly owned by a local authority (Hull City Council) data collected by us may be subject to data matching. Data matching involves comparing computer records held by one body against other computer records held by the same or another body to work out how far they match. This is usually personal information.
Computerised data matching allows potentially fraudulent claims and payments to be identified. Where a match is found it may indicate that there is inconsistency which requires further investigation. No assumption can be made as to whether there is fraud, error or other explanation until an investigation is carried out.
The Cabinet Office currently requires Hull City Council to participate in a data matching exercise to assist in the prevention and detection of fraud. They are required to provide particular sets of data to the Cabinet Office for each exercise and these are set out in the Audit Commission's guidance.
Visit the GOV.UK website to find out more about the National Fraud Initiative.
The use of the data by the Cabinet Office in a data matching exercise is carried out with statutory authority under its powers in part 6 of the Local Authority and Accountability Act 2014 (LAAA). It does not require the consent of the individuals concerned under the Data Protection Act 1998.
Data matching by the Cabinet Office is subject to a code of practice.
You can also access more information about the Audit Commission's legal powers and the reasons why it matches particular information.
CCTV
CCTV systems are installed in public areas across our sites for public safety and the prevention and detection of crime. Signs notifying you that CCTV is in operation are displayed in these areas. They also advise you who to contact for further information.
Images captured by CCTV are not kept for longer than is necessary.
Subject Access Request
You can submit a subject access request if you require a copy of any CCTV images of yourself.
Emails
If you email us, we may store all or part of the details from them on our computer systems. We do not routinely retain all emails we receive.
Telephone calls
You will always be informed if we are recording or monitoring any telephone call you make or receive from us. All calls to our contact centre are recorded.
Audio recordings are only used for the purposes stated in this privacy notice and in accordance with the principles of the Data Protection Act and GDPR. This includes employee training.
You can submit a subject access request if you require a copy of any audio recordings that involve you.