Privacy Notice

Penzance Council is committed to GDPR best practices. We do not share any of your personal data with third parties.

Who we are and what we do

Penzance Town Council is a council in England.

Our contact details are:
Penzance Council, Penlee Centre, Penlee Park, Penzance, TR18 4HE.

The Council is a data controller for personal data as defined by all applicable data protection and privacy laws including, but not limited to, the retained EU law version of the General Data Protection Regulation ((EU) 2016/679) (the “UK GDPR”), as it forms part of the law of England and Wales, Scotland, and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 as amended, and any successor legislation (the “Data Protection Legislation”).

The Council is not required to have a Data Protection Officer as defined by Article 37 of the UK GDPR.

The Council processes your personal data to enable it to manage the authority and provide a service to you and others.

Your data protection rights

Under the data protection legislation, you have rights including:

Your right to be informed – You have the right to be informed of the Council’s use of your personal data. This notice is designed to give you that information. If you require further information, please make contact using the details below.
Your right of access – You have the right to ask the Council for copies of your personal information.
Your right to rectification – You have the right to ask the Council to rectify information you think is inaccurate. You also have the right to ask the Council to complete information you think is incomplete.
Your right to erasure – You have the right to ask the Council to erase your personal information in certain circumstances.
Your right to restriction of processing – You have the right to ask the Council to restrict the processing of your information in certain circumstances.
Your right to object to processing – You have the right to object to the processing of your personal data in certain circumstances.
Your right to data portability – You have the right to ask that the Council transfers the information you gave it to another organisation, or to you, in certain circumstances.
Your right in relation to automated decision making including profiling – the Council does not process personal data in this way.

You are not required to pay any charge for exercising your rights. If you make a request, the law gives the Council one month to respond to you, but it has undertaken to respond as soon as possible and in any case 1 month.

Please contact us using the details provided towards the top of this page or by visiting our contact us page if you wish to make a request.

What data does the data protection legislation cover?

Data protection legislation is to protect the data privacy of individuals and uphold your rights over your own personal data.

Definitions:

Personal Data: means any information relating to an identified or identifiable person (‘data subject’); an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that person.
Processing: means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
Data Controller: means the person or organisation which, alone or jointly with others, determines the purposes and means of the processing of personal data.
Data Processor: means a person or organisation which processes personal data on behalf of the Data Controller.
Third Country: means a country or territory outside the United Kingdom.
Lawful Basis: means one of the six lawful reasons to process personal data as set out in Article 6 of the UK GDPR. At least one of these will apply whenever we process your personal data.

Why does the Council have your information and how long will it keep it?

The Council takes your data privacy seriously and will only use your personal data for the purpose for which it was collected.
For every activity that the Council undertakes using personal data it must be clear what its purpose is for that activity and have a Lawful Basis to process your data.
Where the Council processes personal data that reveals special category data (article 9 UK GDPR) or personal data relating to criminal convictions and offences (article 10 UK GDPR) it requires an additional condition to process.
The Council collects and processes your personal data for the following purposes for which it collects certain categories of data and in order to lawfully process your data for those purposes it relies on these lawful bases and additional conditions.

Purpose	Lawful basis	Additional Condition to Process	Categories of data
Minutes	Legal obligation	N/A	Identity Contact
Accounts	Legal obligation	N/A	Identity Contact Special category data Other Council Contractors Job title
Correspondence and Casework	Public Task	Article 9(g) substantial public interest	Identity Contact Bank Details Pension details Special category data Job title
Payroll	Legal obligation	Article 9(b) employment and social security and social protection	Identity Contact Bank Details
Planning	Public Task	N/A	Identity Contact
Tenancies	Contract	Article 9(g) substantial public interest	Identity Contact Special category data Salary details
HR	Contract	Article 9(b) employment and social security and social protection	Identity Contact
Training	Contract	Article 9(b) employment and social security and social protection	Identity Contact
Training	Public Task	Article 9(a) explicit consent	Identity Contact Special category data Qualifications Employment history
Recruitment	Contract	Article 9(b) employment and social security and social protection	Identity Contact Image Special category data
Town CCTV	Legitimate Interest	Article 9(e) manifestly made public	Image
Office CCTV	Legitimate Interest	Article 9(g) substantial public interest	Image
Room Bookings (free)	Legitimate Interest	N/A	Identity Contact
Room Bookings	Contract	N/A	Identity Contact Special category data
Communications and community engagement	Legitimate Interest	Article 9(a) explicit consent	Identity Contact Special category data
Communications and community engagement (Email)	Consent	Article 9(a) explicit consent	Identity Contact
Use of Council Land (free)	Legitimate Interest	N/A	Identity Contact
Use of Council Land	Contract	N/A	Identity Contact
Website sales	Contract	N/A	Identity Contact
Penzance Pass Records	Consent	N/A	Identity Contact
Invitations to Gallery viewings	Legitimate Interest	N/A	Identity Contact
Collections Management	Legitimate Interest	N/A	Identity Contact
Penlee House stewards and volunteers	Legitimate Interest	Article 9(a) explicit consent	Identity Contact
Penlee House Enquiries and Correspondence	Legitimate Interest	Article 9(a) explicit consent	Identity Contact Special category data
Penlee House Community Engagement	Legitimate Interest	Article 9(a) explicit consent	Identity Contact Special category data
Penlee House Community Communications	Consent	Article 9(a) explicit consent	Identity Contact
Friends of Penlee House Membership	Contract	N/A	Identity Contact Special category data
Allotments	Contract	Article 9(a) explicit consent	Identity Contact Vehicle details
Car Parking Permits	Contract	N/A	Identity Contact
Memorials	Contract	N/A	Identity Contact
Strategic partnerships	Contract	N/A	Identity Contact Special category data
Awards Nominations	Legitimate Interest	N/A	Identity Contact
Awards Awarding	Consent	Article 9(a) explicit consent	Identity Contact
Photographs	Legitimate Interest	Article 9(e) manifestly made public	Image
Photographs	Consent	Article 9(a) explicit consent	Image
Register of Interest	Legal obligation	Article 9(g) substantial public interest	Identity Contact
Councillor Information	Public Task	Article 9(g) substantial public interest	Identity Contact Special Category Data

If the Council has relied on ‘consent’ to process your personal data, you are able to withdraw that consent at any time and it will assist you.

The Council collects data in the following ways:

Categories of data	How we collect your data
Bank Details	Direct from you
Contact	Direct from you Cornwall Council
Employment history	Direct from you
Identity	Direct from you Cornwall Council
Job title	Direct from you
Other Council Contractors	Direct from you
Pension details	Direct from you
Qualifications	Direct from you
Salary details	Direct from you
Special category data	Direct from you From Someone who has nominated you for an award
Vehicle details	Direct from you

How long the Council intends to keep your data

Purpose	How long we will keep your data
Minutes	Permanent Archive
Accounts	6 years
Correspondence and Casework	1 year after conclusion of case
Payroll	6 years
Planning	Permanent archive
Tenancies	Duration of tenancy plus 2 years
HR	6 years post-employment
Training	6 years post-employment
Recruitment	6 months
Town CCTV	30 days
Office CCTV	28 days
Room Bookings (free)	3 Years After Booking
Room Bookings	6 Years After Booking
Communications and community engagement	Until 3 years of no response
Communications and community engagement (Email)	Until unsubscribe
Use of Council Land (free)	3 Years after booking
Use of Council Land	6 Years after booking
Website sales	3 months
Penzance Pass Records	2 years from issue
Invitations to Gallery viewings	Until unsubscribe
Collections Management	Indefinitely
Penlee House stewards and volunteers	Whilst active volunteer
Penlee House Enquiries and Correspondence	Up to 7 years
Penlee House Community Engagement	Until consent revoked
Penlee House Community Communications	Until unsubscribe or unconsent
Friends of Penlee House Membership	4 years post membership
Allotments	Duration of tenancy + 2 years
Car Parking Permits	Until end of the quarter
Memorials	Permanent Archive
Strategic partnerships	6 Years after contract
Awards Nominations	12 months
Awards Awarding	Until consent withdraw
Photographs	Permanent archive
Photographs	Permanent archive
Register of Interest	Until they are no longer a councillor and have been replaced by a new councillor.
Councillor Information	1 council term after leaving

When the Council no longer needs your personal data to undertake its stated purpose it will delete it or anonymise it so that it no longer permits the identification of you.

Personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with UK GDPR Article 89(1). In some cases, the Council may be allowed to use your personal data to contact you with news about its activities, products or services. The Council will always offer an opt out and will always comply with the data protection legislation.

Sharing this information with other data controllers

The Council may share your data with another data controller if that controller takes over the purpose for which it collected your data.

The Council may be required to share your personal data for legal, judicial, law enforcement or government reasons.

We routinely share personal data with other data controllers for the following reasons:

Purpose	Receiving Data Controller	Data Controller Location
Accounts	HMRC	UK EU
Correspondence and Casework	Other Local Authority Expert Helpers Law enforcement and similar competent authorities Contractors and suppliers Members of the public Officers	UK EU
Payroll	HMRC Pension Provider	UK EU
Planning	Other local authority	UK
HR	Other local authority	UK
Training	Other local authority Council associations Worknest iHasco First Aid Cornwall High Speed Training ROSPA Liam Cottrell Kernow Lantra Training HSQE Breakthrough Communications Fire Safety Cornwall Cornwall College Corserv	UK EU
Training	Other local authority Council associations NALC SLCC Worknest iHasco Breakthrough Communications	UK EU
Town CCTV	Law enforcement and similar competent authorities	UK
Office CCTV	Law enforcement and similar competent authorities	UK
Photographs	Press and media Social media	UK EU
Register of Interest	Other local authority	UK
Councillor Information	Other local authority	UK

The Council may share your personal data with other data controllers to enable it to fulfil its obligations to you or to provide a product or service, in that event it will tell you who it is going to share your data with.

The Council takes your data protection rights seriously and will take steps to ensure that those it shares data with process it responsibly.

Data processors working on the Council’s behalf

The Council may send your data to a data processor to undertake data processing activities on its behalf.

The Council sends personal data to data processors for the following reasons:

Categories of Data Processor	Purpose	Data Processor Location
AdvantEdge	Accounts Room Bookings Use of Council Land Friends of Penlee House Membership Allotments Car Parking Permits Memorials Strategic partnerships	EU
Canva	Communications and community engagement Communications and community engagement (Email) Photographs Photographs Councillor Information	Australia
Collections database – Modes Complete	Collections Management Friends of Penlee House Membership Strategic partnerships	UK
Health Assured	Employee Assistance Provider	UK
Mailchimp	Communications and community engagement Communications and community engagement (Email) Website sales Invitations to Gallery viewings Penlee House Community Engagement Penlee House Community Communications Strategic partnerships Photographs	USA
Microsoft	Minutes Accounts Correspondence and Casework Payroll Planning Tenancies HR Training Training Recruitment Office CCTV Room Bookings (free) Room Bookings Communications and community engagement Communications and community engagement (Email) Use of Council Land (free) Use of Council Land Website sales Penzance Pass Records Invitations to Gallery viewings Collections Management Penlee House stewards and volunteers Penlee House Enquiries and Correspondance Penlee House Community Engagement Penlee House Community Communications Friends of Penlee House Membership Allotments Car Parking Permits Memorials Strategic partnerships Awards Nominations Awards Awarding Photographs Photographs Register of Interest Councillor Information	UK
Online payment link provider	Allotments Car Parking Permits	UK
Payroll provider	Payroll	EU
Royal Mail	Website sales	UK
Security contractor	Town CCTV	UK
SumUp payment provider	Accounts Allotments Car Parking permits	EU
Website server provider	Minutes Planning Communications and community engagement Communications and community engagement (Email) Website sales Penlee House Enquiries and Correspondence Penlee House Community Engagement Penlee House Community Communications Friends of Penlee House Membership Car Parking Permits Strategic partnerships Awards Awarding Photographs Photographs Register of Interest Councillor Information	UK
Worknest	HR	UK
Worksmarter	HR	UK

Where does the Council store and process your personal data?

Most of your personal data will be stored and processed here in the UK.

Some data may be stored or processed in other third countries. The Council has made sure that safeguards are in place on such transfers to ensure that an equivalent standard of data protection is in place.

Personal data transferred to EU member states, Iceland, Norway, Liechtenstein, Gibraltar, Andorra, Argentina, Faroe Islands, Guernsey, Isle of Man, Israel, Jersey, New Zealand, Switzerland, Uruguay, Japan (only private sector organisations) or Canada (only covers data that is subject to Canada’s Personal Information Protection and Electronic Documents Act) is transferred to those third countries on the basis of adequacy regulations.

Personal data transferred to USA organisations certified to the “UK Extension to the EU-US Data Privacy Framework” is transferred on the basis allowed for by Article 45 of the UK General Data Protection Regulation (GDPR).

Personal data transferred to other USA organisations and all other countries is transferred on the basis of International Data Transfer Agreements (IDTAs) where there is a contract incorporating an agreement recognised or issued in accordance with the data protection legislation. The IDTA contains contractual obligations on us (the data exporter) and the receiver (the data importer), and rights for the individuals whose personal data is transferred.

How to contact the Council for more information

If you have any questions, wish to exercise any of your data protection rights or have a complaint please contact Penzance Town Council, Penlee Centre, Penlee Park, Penzance, TR18 4HE.

You can also contact us via our website.

You can also complain to the Information Commissioner’s Office (ICO) if you are unhappy with how the Council has used your data. Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF Helpline number: 0303 123 1113

Updates to this notice

The Council might have to make changes to this Privacy Notice if there are changes to how it processes your personal data or the data protection legislation changes.

Changes will be made available via updated notices on the Penzance Town Council Website and at the Penzance Town Council offices at the above address.

This Privacy Notice was last updated on 16/3/26.