Privacy Policy – May 2025
Purpose of the notice
The purpose of this notice is to explain how Sheringham Town Council (“STC” and/or “the Council”) processes personal data to fulfil its data protection responsibilities.
This notice covers individuals whose details are processed when using Council services including, but not limited to:
- Hiring of the Sheringham Community Centre
- Entering into an allotment tenancy agreement
- The purchase of the exclusive rights to a cemetery plot
- Nominators and nominees for the Sheringham Community Award scheme
- Referees provided by applicants for employment or contract work
- Being recorded by one or more cameras of STC’s CCTV system
Data controller and contact details
Sheringham Town Council is the data controller and determines the purpose and use of personal data collected.
Once received, it is the responsibility of the Council’s Data Manager (DM) to ensure data is processed in accordance with UK data protection legislation.
The Data Manager can be contacted at:
info@sheringhamtowncouncil.gov.uk
Personal data we process
The personal data processed by STC typically includes basic contact information for:
- Responding to general enquiries
- Conducting routine council business
- Preparing contracts
- Setting up invoices
In some circumstances, STC may need to process health-related data. This will only be done with explicit consent.
If STC is not provided with all requested information, it may result in an incomplete service being provided.
CCTV and public safety
STC operates a CCTV system in and around the town to enhance public safety and to assist with the prevention and detection of crime.
This system is governed by a separate management policy and risk assessment.
Images are not routinely monitored, are stored for 30 days, and may be used to assist with public enquiries or law enforcement agencies where appropriate.
Confidentiality and data sharing
STC treats personal data with due respect and confidentiality and expects the same standard from any third parties it engages.
Personal data will only be disclosed where lawful circumstances allow.
Where third parties process personal data on behalf of STC, an appropriate data processing agreement (or equivalent) will be in place.
Where and how we store your data
Personal data is processed in the UK and backed up locally and with a cloud service provider where servers are based in the EU.
- Email is processed via a reputable web-based provider
- Email and mobile contact details are stored on Council IT equipment, including councillor devices
- Appropriate technical and organisational measures are in place to keep data secure
Lawful bases for processing
STC routinely processes personal data under one or more of the following lawful bases:
- When necessary for tasks carried out in the public interest and in exercise of the official authority vested in STC by UK legislation
- To fulfil contractual obligations, including contract preparation
- Where processing is necessary for legitimate interests
- To comply with legal obligations
- When consent has been obtained for a specific purpose (consent can be withdrawn at any time)
All processing of personal data is carried out in accordance with UK data protection principles and legislation.
Who may we share your data with
Where necessary, personal data may be shared with:
- North Norfolk District Council
- Norfolk County Council
-
Administrative support providers bound by contractual and data processing agreements
-
Banks handling financial transactions
-
Sheringham Allotment Association (for allotment holders)
-
Auditors, suppliers and insurance companies
Data retention
shown below:
- Routine correspondence for casual enquiries: retained for up to 1 year
- Contract-related data: retained for the life of the contract plus 7 years
- Contact data: retained indefinitely unless a valid erasure request is received
- Financial records and invoices: retained for 7 years
In limited circumstances, data may be retained beyond this period where there is a legitimate interest or legal obligation.
At the end of the retention period, data will be returned, deleted, or destroyed. Where deletion is not technically possible, data will be put beyond operational use.
Cookies and external websites
The STC website uses cookies. Visitors are asked to consent to non-essential cookies before they are placed.
The website may include links to external websites. STC is not responsible for the content, control, or data handling practices of those external sites.
Your data protection rights
Under the UK General Data Protection Regulation (UK GDPR), individuals have rights, although these do not apply in all circumstances.
These rights include:
- Right to be informed as to how personal data is being processed – this is done through this notice or specific to audience privacy notices
- Right to access personal data held by STC which is done by submitting a ‘Data Subject Access Request’ (DSAR)
- Right to rectification of personal data if STC has collected it incorrectly or it needs to be updated
- Right to erasure of personal data for which STC no longer has a legitimate purpose to process
- Right to restrict processing under certain circumstances, during which time personal data but will be out of operational use until the matter is resolved
- Right to data portability in a machine-readable version, but this only applies to data provided with consent or under contract
- Right to object to processing personal data for which STC does not have a legal or contractual obligation
- Rights related to automated decision making and profiling, however STC does not use these techniques in its decision making
Further information is available from the Information Commissioner’s Office (ICO).
Raising concerns or exercising your rights
STC will need to verify your identity before responding and may request appropriate identification.
Alternatively, you may contact the ICO using the details above.
