NORTHWOOD HOUSE CHARITABLE TRUST COMPANY LIMITED

NORTHWOOD HOUSE TRADING COMPANY LIMITED

NORTHWOOD HOUSE CHARITABLE TRUST

PRIVACY NOTICE

 (STAFF, MEMBERS, TENANTS AND LICENCEES)

1. Introduction

• Northwood House Charitable Trust Company Limited (NHCTCL) is the sole Trustee of the Northwood House Charitable Trust, which is the owner of Northwood House and Park (collectively referred to as the Estate). Northwood House Trading Company Limited (NHTCL) is the solely owned subsidiary of NHCTCL.  This Policy is prepared and maintained by NHCTCL on behalf of all the above-named entities.
• NHCTCL is committed to maintaining the accuracy, confidentiality and security of your personal information.  We would ask that you read this Privacy Notice carefully, as it contains information as to:
• The personal data we may collect about you
• How we look after personal data
• The real and legal persons whom your personal data might be shared
• Your privacy rights under the law
• This Notice applies to:
• Members of NHCTCL
• Directors of NHCTCL and NHTCL
• Members of staff
• Tenants
• Licensees
• Persons entering into contractual relations with NHCTCL or NHCTL

2. What Personal Information Do We Collect?

• Personal data is information relating to an identified or identifiable natural person. Personal information does not include anonymous or non-personal information.
• We collect and maintain different types of personal information in respect of those individuals who seek to be, are, or were members of staff, volunteers, members, tenants or licensees or Directors as well as in relation to those seeking or applying for such positions. We also collect information about individuals who have or have sought contractual relations with us. We may collect personal information in relation to:
  • Applications for employment by or membership of NHCTCL or to volunteer on the Estate, whether including forms supplied by us or CVs or other documents prepared by you.
  • Photographs and videos we may have taken or have been supplied with.
  • Financial information including but not limited to credit card details, national insurance numbers, banking and deposit information, which have been provided to us when you purchase or make payment for any of the services we provide
  • Surveys and feedback forms which you have filled out
  • Next of kin, beneficiary and emergency contact information.

• In addition to the examples listed above, personal information also includes information such as name, home address, telephone, personal email address, date of birth, and marital status, and any other information necessary for the purposes of running the Estate, which is disclosed in the course of an individual’s application to join any of the categories identified within Paragraph 1 above or in the making of a contractual agreement or other comparable legal relationship.
• As a general rule, we collect personal information directly from you. In most circumstances where the personal information that we collect about you is held by a third party, we will obtain your permission before we seek out this information from such sources (such permission may be given directly by you, e.g. by providing the names and contact information for references or professional advisors with whom you wish us to communicate).
• We do not, as a rule, collect special category personal data. The only information we may from time to time collect is in relation to particular vulnerabilities or allergies you may have. We do so in order to ensure that as far as possible, you are not exposed to situations, substances or environments which have particular potential to harm you and in order to provide a safe environment for all staff, volunteers and visitors. We do not ask for such data except as part of the later stages of the job application process. Where we make such enquiries, we will explain why we need that information and how we intend to use it.
• Where permitted or required by applicable law or regulatory requirements, we may collect information about you without your knowledge or consent.
• We do not store personal information on servers outside the European Economic Area.

3. Why Do We Collect Personal Information?

• The personal information collected is used and disclosed for purposes of managing the business of the Estate. These purposes include establishing, managing or terminating your employment, membership, tenancy or licence. Such uses may include:
• Where you have provided appropriate consent, contacting you to inform you about upcoming events on the Estate or providing information about your membership. We will only do this where you have provided explicit consent for us to do so.
• Determining your suitability for appointment to the position for which you have applied.
• Determining your suitability for membership of NHCTCL or to act as a volunteer on the Estate
• Managing and delivering those services provided by NHCTCL and NHTCL, including although not limited to the staging of events, the provision of premises for rental and the provision of car parking facilities.
• Fulfilling our contractual obligations.
• Gathering evidence for disciplinary action, or termination of employment.
• Establishing a contact point in the event of an emergency (such as your next of kin).
• Conducting research and statistical analysis. We will only do this in an anonymised manner and not in a form in which you can be identified from your information.
• Ensuring the security of information held by NHCTCL.

4. Monitoring

• As part of our management of the Estate, we may monitor the premises and property, including making use of CCTV installations. Where they are in use, CCTV cameras are there for the protection of employees, members and volunteers as well as visitors to the Estate. We also make use of them for the protection of the House and Park.
• Usually, recorded images will be routinely destroyed within a short period of time. We will not share them with third parties, unless we suspect that a crime has been committed, in which case we may provide them to the police or other appropriate government agency or authority to assist in its enquiries. We do not operate constant surveillance of the entirety of the Estate. However, you should be aware that such monitoring may occur and that it may result in the collection of personal information.

5. How Do We Use Your Personal Information?

• We may use your personal information for:
  • the purposes described in this Privacy Notice;
  • any additional purposes that we may from time to time inform you of. Where your consent is required by law to do this, we will ensure that have obtained your consent in respect of the use or disclosure of your personal information before doing so.
• We may use your personal information without your knowledge or consent where we are permitted or required by applicable law or regulatory requirements to do so.

6. When Do We Disclose Your Personal Information?

• We do not and will not sell any of your personal data to a third party. We may provide personal data to third parties in order that they can provide us with services to run the Estate. These purposes may include:
  • Service providers allowing you to make payment to us by credit card or on our website;
  • Service providers including marketing agencies, website hosting providers, website developers, providers of wi-fi access and distributors of printed or digital information;
  • Professional advisors including accountants, auditors, lawyers and bankers who may require it to provide us with advice.
• We do not allow such third parties to use your data for their own purposes and expect them to use your personal data for the specified purposes alone and within the requirements imposed by law. If you require any more information about the third parties who may have access to your data, please contact the Estate Administrator.
• In addition your personal information may be disclosed:
  • As permitted or required by applicable law or regulatory requirements. Where we do so, we will not disclose more personal information than is required under the circumstances.
  • To comply with valid legal processes such as search warrants, subpoenas or Court orders.
  • To protect the rights and property of and in the Estate.
  • During emergency situations or where necessary to protect the safety of a person or group of persons.
  • Where the relevant personal information is already publicly available.
  • With your consent where such consent is required by law

7. Notification and Consent

• Privacy and employment laws do not generally require us to obtain your consent for the collection, use or disclosure of personal information for the purpose of establishing, managing or terminating employment.
• Where your consent is required we will ensure that we communicate the need for the consent and what you are consenting to as clearly as possible. In circumstances where you have given us consent for the collection, use or disclosure of your personal information, you may, at any time, subject to legal or contractual restrictions, withdraw your consent
• All communications with respect to such withdrawal or variation of consent should be in writing and addressed in the first instance to the Estate Administrator of NHCTCL.

8. How is Your Personal Information Protected?

• NHCTCL endeavours to maintain physical, technical and procedural safeguards that are appropriate to the sensitivity of the personal information in question. These safeguards are designed to protect your personal information from loss and unauthorised access, copying, use, modification or disclosure.
• We allow employees only access to that personal data which is required for their role. We store personal data on IT systems protected by password and suitable secure servers and.

9. How Long is Your Personal Information Retained?

• Except as otherwise permitted or required by applicable law or regulatory requirements, NHCTCL will retain your personal information only for as long as it believes is necessary to fulfil the purposes for which the personal information was collected (including, for the purpose of meeting any legal, accounting or other reporting requirements or obligations with which we may ned to comply).
• We may, instead of destroying or erasing your personal information, make it anonymous such that it cannot be associated with or tracked back to you. In most cases your data will be deleted six years after leaving employment or membership or after the conclusion of any contractual relationship between us. If you have applied to join NHCTCL or to be employed by us and have been unsuccessful we will retain your data for six months, after which time it will be deleted.

10. Updating and/or Rectifying Your Personal Information

• It is important that the information contained in our records is both accurate and current. If your personal information happens to change during the course of your employment, membership or other relationship with us, we would be grateful if you would ensure that we are made aware of any such changes as soon as possible.
• You are entitled to request that we rectify data we hold about you if it is inaccurate or incomplete. In some circumstances we may not agree with your request to change your personal information and will in such circumstances instead append an alternative text to the record in question. Where we do this, we will ensure that the reasons for our stance are made clear to you.

11. Access to Your Personal Information

• You can ask to see the personal information that we hold about you. We will endeavour to respond within one calendar month of receipt of your request. If you want to review, verify or correct your personal information, please contact the Estate Administrator. Any such communication should be in writing.
• When requesting access to your personal information, please note that we may request specific information from you to enable us to confirm your identity and right to access, as well as to search for and provide you with the personal information that we hold about you. We may charge you a fee to access your personal information; however, we will advise you of any fee in advance. If you require assistance in preparing your request, please contact the Estate Administrator.
• Your right to access the personal information that we hold about you is not absolute. There are instances where applicable law or regulatory requirements allow or require us to refuse to provide some or all of the personal information that we hold about you. In addition, the personal information may have been destroyed, erased or made anonymous in accordance with our record retention obligations and practices.
• If we cannot provide you with access to your personal information, we will try to inform you of the reasons why, subject to any legal or regulatory restrictions.

12. Your other legal rights

• Data protection legislation also provides you with certain other rights. Please note that none of these are absolute rights and must be considered in the wider scope of the legislation and in the context of any other applicable statutory guidance which may be in force at the time. These rights are:
• The right to erasure, also known as the right to be forgotten. The broad principle underpinning this right is to enable an individual to request the deletion or removal of personal data where there is no compelling reason for its continued processing
• The right to restrict processing. You have the right to “block” or suppress processing of personal data. Again this is not an absolute right and will depend on the circumstances and any other legal/statutory obligations which we may have.
• The right to data portability. This only applies to information which you have provided to us.
• The right to object to processing based on legitimate interests or the performance of a task in the public interest or the exercise of official authority (including profiling).
• Rights related to automated decision making including profiling.