1. Introduction
This Privacy Policy Statement sets out what information the parish council holds about a person, why it is held and how the parish council protects this personal data. The processing of personal data is governed by legislation including the UK General Data Protection Act, other legislation relating to personal data and rights such as the Human Rights Act. This Privacy Policy Statement can be read in conjunction with the parish council’s Data Protection Policy.
Personal data is defined as any information about a living individual which allows them to be identified from the data, for example a name, photographs, email address or address. Identification can be directly using data itself or combining it with other information which helps to identify a living individual.
2. The Parish Council’s Right to Process information
Ashburnham with Penhurst Parish Council is the data controller and this means the council decides how your personal data is processed and for what purpose.
The parish council has the right to process information as follows:
- with consent of the data subject
- necessary for compliance with a legal obligation
- necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller
Your personal data will be treated as strictly confidential, and your personal data will not be shared with any third party unless another law permits this.
3. How Does the Parish Council Process and Use Your Data
Ashburnham with Penhurst Parish Council complies with its obligations under the General Data Protection Act 2018 Article 6 (1) by:
- keeping personal data up to date
- destroying it securely
- not collecting or retaining excessive amounts of data
- ensuring appropriate technical measures are in place to protect personal data
The parish council uses your data for the following purposes:
- to enable the parish council to contact residents
- to maintain our accounts and records
- to manage our employees and volunteers
- to fundraise and promote the interests of the parish council
- to inform the public of news, events, activities and services
Data provided to the parish council helps the parish council to inform decisions in respect of the facilities it provides to the community and assists the parish council on feeding back local opinion to other parts of local government e.g. planning matters as well as enabling the parish council to answer and respond positively to resident’s questions and concerns.
Personal Data Processed by Ashburnham with Penhurst Council and the Lawful Basis for Processing
For each activity involving personal data, the council must identify a clear purpose and an appropriate lawful basis for processing. The table below sets out the purposes for which the council collect and use your personal data, the categories of data involved, and the lawful basis and any additional conditions we rely on.
| Lawful basis | Meaning |
| Consent | The person has given consent for the council to use their information for a specific purpose. |
| Contract | Necessary for a contract with the individual or requested pre-contract steps. |
| Legal obligation | Necessary to comply with the law, excluding contractual duties. |
| Vital interests | Necessary to protect someone’s life. |
| Public task | Necessary for a public-interest task or official function to be a statutory function. |
| Recognised legitimate interest | Limited to listed public-interest purposes such as emergencies, crime, safeguarding, national security or sharing personal information with an organisation that requires it for a public task. |
Staff and Employment
| Processing Purpose | Data Processing | Lawful Basis | Reason |
| Recruitment and appointment decisions | CV, cover letter, qualifications, work history, references and recruitment source | Contract / Legal obligation / Public task | Contract covers requested pre-employment steps; legal obligation covers right-to-work/equality duties; public task may support accountable public recruitment. |
| Determining employment terms | Identity, contact, role, workplace, employment status, qualifications and proposed terms | Contract | Necessary to take steps before entering employment and to establish the employment relationship. |
Staff and Employment
| Processing Purpose | Data Processing | Lawful Basis | Reason |
| Checking the right to work in the UK | Passport, immigration status, right-to-work documents and identifiers | Legal obligation | Necessary to meet the employer’s legal right-to-work duties. Retain only the required evidence for the required period. |
| Employment-contract administration | Start/leaving dates, contact details, role, workplace, performance, leave, licences and employment records | Contract / Legal obligation / Public task | Use contract for necessary employment administration, legal obligation for employment duties and public task only where linked to a council function. |
| Disciplinary and grievance management | Identity, employment records, allegations, evidence, performance and outcome | Contract / Legal obligation / Public task | May be necessary to administer employment, comply with employment law and manage the council as a public authority. |
| Accidents, injuries and insurance claims | Visitor/employee identity, incident details, injuries, witnesses, policy and claim numbers | Legal obligation / Public task | Legal obligation may cover health-and-safety and reporting duties; public task may cover management of council premises and services. |
| Emergency contact and life protection | Next-of-kin details, emergency contact and necessary health/incident information | Vital interests | Use only where processing is necessary to protect someone’s life. Routine storage of emergency contacts may require another basis, such as contract or legitimate interests outside a public task. |
| Emergency, safeguarding or crime response | Necessary identity, incident, location, person, IT-log or allegation data | Recognised legitimate interest – only if a listed condition is met | This basis is limited to the statutory conditions for emergencies, safeguarding, crime, public/national security or a qualifying public-task disclosure. |
Payroll
| Processing Purpose | Data Processing | Lawful Basis | Reason |
| Sharing data with public bodies, HMRC or payroll provider | Identity, contact, pay, tax, employment and transaction information | Legal obligation / Contract | Legal obligation applies to sharing payroll information with HMRC and other public bodies where required by law, including tax and National Insurance reporting. Contract applies where processing is necessary to pay staff under their employment contracts. A payroll provider processes the necessary data on the council’s behalf under a data processing agreement. |
| Pay, tax and National Insurance | Bank details, NI number, tax code, pay, deductions, expenses and payment identifiers | Contract / Legal obligation | Contract is needed to pay agreed remuneration; legal obligation applies to tax, National Insurance and statutory reporting. |
| Contractual benefits | Identity, employment status, eligibility, dependant and benefit information | Contract / Legal obligation | Contract applies where processing is necessary to provide agreed benefits; legal obligation may apply to statutory benefits. |
Pensions
| Processing Purpose | Data Processing | Lawful Basis | Reason |
| Pension administration | Identity, NI number, pay, contribution, beneficiary and dependent information | Legal obligation / Contract | Legal obligation is normally central to automatic-enrolment and pension duties; contract may apply to agreed pension administration. |
Finance and Procurement
| Processing Purpose | Data Processing | Lawful Basis | Reason |
| Accounts | Names, contact details, invoices, payments, expenses, bank details and audit records | Legal obligation / Public task | Necessary for statutory accounts, financial administration, audit and lawful inspection of public accounts. |
| Suppliers, contracts and tenders | Supplier contacts, quotations, tenders, contracts, bank details, insurance and performance records. | Contract / Legal obligation / Public task | Contract applies to necessary dealings with individuals; legal obligation and public task may apply to procurement, transparency and financial governance. |
| Management, planning, accounting and audit | Staff identifiers, pay/expenses, performance, operational, transaction and audit records | Legal obligation / Public task | Necessary for statutory accounting/audit duties and responsible administration of a public authority. |
Facilities and Events
| Processing Purpose | Data Processing | Lawful Basis | Reason |
| Hire of Pavilion and Grounds | Hirer contact details, booking information, payments, insurance, access needs and incident records. | Contract / Legal obligation / Public task | Contract applies to booking and hire; legal obligation may cover safety and accounts; public task may cover management of council facilities. |
| Event records | Organiser’s details, booking information, payments and insurance details. | Contract / Public task / Legal obligation / Consent | Use the basis matching each purpose: booking, council event delivery, safety, or optional publicity and marketing. |
Correspondence and Communications
| Processing Purpose | Data Processing | Lawful Basis | Reason |
| Correspondence | Names, contact details, correspondence, complaints, service requests, opinions and supporting evidence | Public task / Legal obligation | Usually it is necessary to carry out council functions or respond under a legal duty; consent is not normally needed simply to answer correspondence. The Clerk responds on behalf of the council being a corporate organisation. |
Correspondence and Communications
| Processing Purpose | Data Processing | Lawful Basis | Reason |
| Official event photographs | Images, video, captions, names, roles and event details | Public task | For reporting on community events where publication is necessary and proportionate for official council reporting. The council must establish a process to inform attendees that photographs are being taken and explain how they may be used. |
| Social media | Usernames, public comments, direct messages, images, moderation records and platform analytics | Public task | Use for official council communications and website. |
| Press releases | Names, roles, contact details, quotations, photographs and relevant contextual information | Public task / Legal obligation / Consent | Public task applies to official communications; legal obligation to required publication; consent to optional personal stories, quotations or portraits. |
| Website publication | People named in published documents, photographs contact details, technical logs. | Public task / Legal obligation / Consent | Public task and legal obligation apply to council services and publication; consent applies to personal information. |
| Third-party management of council data | Names, contact details, correspondence, council records and system logs needed for outsourced storage, hosting, backups and IT support. | Public task / Legal obligation; otherwise the lawful basis for the underlying activity. | To support council functions and duties. Providers acting as processors must follow documented council instructions under an Article 28 agreement, with appropriate confidentiality and security safeguards. The council has a Data Sharing and Non-Disclosure agreements in place – September 2026.. |
| IT and communications security monitoring | Account identifiers, device and system-use information, security and access logs | Legal obligation / Public task | To protect the IT system, email accounts, and electronic communications against unauthorised access, malware, phishing and other security threats. |
Governance and Councillors
| Processing Purpose | Data Processing | Lawful Basis | Reason |
| Minutes, agendas and meeting papers | Names, roles, attendance, declarations, statements, correspondence and decision records | Legal obligation / Public task | Necessary for statutory meetings, democratic decision-making, transparency and publication duties. |
| Councillor information | Names, roles, official contact details, committee membership, attendance, training, allowances and declarations | Public task / Legal obligation | Necessary to administer elected members and comply with governance, transparency and financial duties. |
| Councillors’ register of interests | Identity, office, employment or business, land, securities, gifts, memberships and connected-person interests | Legal obligation / Public task | Necessary to collect, maintain and publish interests under standards and local-government law. |
Community Grants and Planning
| Processing Purpose | Data Processing | Lawful Basis | Reason |
| Grant applications to the council | Applicant contacts, project details, declarations, bank details, financial information and monitoring records | Public task / Legal obligation / Contract | Public task applies to grant-making under a council power; legal obligation to finance and audit; contract may cover an award agreement. |
| Planning applications | Applicant, agent and resident details, property addresses, representations, plans and council responses | Public task / Legal obligation | Necessary for the council’s planning-consultee role and related meeting and publication duties. |
4. Compliance with Data Protection Law
The data protection law states that the personal data the parish council holds about a person must be:
- used lawfully, fairly and in a transparent manner
- collected only for valid purposes that the parish council have clearly explained to the person and not used in any way that is incompatible with those purposes
- relevant to the purposes the parish council has informed you and limited only to those purposes
- accurate and kept up to date
- kept only as long as necessary
- kept and destroyed including ensuring the appropriate technical and security measures are in place to protect a person’s personal data, to protect personal data from loss, misuse, unauthorised access and disclosure
- never disclosed without consent of the persons unless required by law
5. How Long Does the Parish Council Keep Your Personal Data
The legislation provides that personal data will only be retained under the following circumstances:
- consent from the data subject is held
- the data is necessary for the performance of a contract
- there is a legal obligation to hold it
- holding data is important to protect the interests of the data subject or another person
- holding the data is in the public interest; or
- the parish council has a legitimate interest in holding it (except where such an interest is overridden by the interests or rights of the data subject)
The parish council has a Document Retention Policy which sets out what documents and for how long documents they are held as required under section 224 of the Local Government Act 1972.
6. Your Rights and Your Personal Data
Unless subject to an exemption under the General Data Act 2018, a person has the following rights in respect to your data:
- the right to be informed. Such rights are set out in this Privacy Policy Statement.
- the right to request a copy of your personal data which Ashburnham with Parish Council holds about them
- the right to request that Ashburnham with Parish Council corrects any personal data if it is found to be inaccurate or out of date
- the right for a person to request their personal data is erased where it is no longer necessary for the Parish Council to retain such data
- the right to withdraw the persons consent to the processing at any time
- the right to request that the data controller provide the data subject for the person to request the data is transferred directly to another data controller (known as the right to data portability) where applicable. This only applies where the processing is based on consent or is necessary for the performance of a contract with the data subject and in either case the data controller processes by automated means
- the right where there is a dispute in relation to the accuracy or the processing of your data, to request a restriction is placed on further processing
- the right to object to the processing of personal data (where applicable). This only applies where processing is based on legitimate interests (or the performance of a task in the public interest / exercise of official authority)
- the right to lodge a complaint with the Information Commissioners Office
7. Information Security
Ashburnham with Penhurst Parish Council has a duty to ensure the security of personal data and has put in place appropriate electronic and management procedures to safeguard and secure the data collected.
Please contact the Clerk for any further information on clerk@ashburnham-penhurst-pc.gov.uk or by mobile on 07443 490541.
Should you wish to make a complaint about the use of your personal data, you can contact the Information Commissioners Office:
- Helpline number: 0303 123 1113
- Website: ico.org.uk/make-a-complaint
- The Information Commissioners address:
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Date of Policy: September 2026
Date Adopted: 23 September 2026
Minute Reference:
Date for Next Review: