The Purpose of this privacy notice is to explain how Chapel and York Limited (“CY”), processes personal data to fulfil its general data protection responsibilities to the general public using this website to make enquiries about the company. Separate notices are provided to clients, contractors and employees.
The Role of CY in data protection terms are as follows:
CY is a Data Controller for the purposes of processing your personal data to respond to your enquiries. This is because CY makes decisions about why personal data is collected, and how it is processed
It is the responsibility of the CY privacy manager (PM) to ensure that all personal data is processed in accordance with UK’s data protection legislation. The PM can be contacted by email using datacompliance@chapel-york.com.
The personal data processed by CY will be basic contact information for the purposes of responding to general enquiries. Once the exact nature of your enquiry has been established, then further details will be requested and a more relevant privacy notice will be made available at that time. If CY is not given all the requested information, it may result in an incomplete service being provided.
CY’s duty of confidentiality means that CY will treat personal data with due respect and in confidence. CY expects the same duty of confidentiality of all third parties with whom it shares personal data. It will only be disclosed when lawful circumstances allow. When it is necessary to engage third parties to process personal data, for which CY is the data controller, a data processing agreement (or equivalent) between both parties will be put in place.
CY will process your personal data in the UK, which it is backed up locally and with a cloud service provider based in the UK and the EU. Email is processed using a reputable web-based provider. Email and mobile phone contacts are stored on office IT equipment and mobile phones. CY uses appropriate technical and organisational measures to ensure your personal data is kept secure.
CY will routinely process your personal data against a lawful basis as described below:
- When processing is necessary for the purposes of our stated legitimate interests such as responding to your enquiries and to stay in touch with you for marketing purposes
- To comply with our legal obligations
- When processing against a pre-defined purpose for which your consent has been sought and recorded beforehand; please note that consent can be withdrawn at any time by asking the privacy manager
In all cases the processing of personal data shall be done in accordance with the principles of data protection as set out in UK’s data protection legislation.
CY will share your personal data, only when it is necessary, with some or all of the following third parties:
- IT support companies that are subject to a data processing agreement
- Appropriate third-party organisations, but only with your prior permission
- Unspecified recipients but only when compelled to do so for legal reasons
CY will retain your personal data for casual enquiries in hard copy or in emails for 3 years after the last interaction with CY.
By exception, documentation that includes personal data may be retained by CY beyond the schedule, but only for a specific purpose and only when CY has a legitimate interest or a legal obligation to do so.
At the end of the retention period, CY will either return, destroy or delete your personal data and any associated emails or relevant documentation. If it is technically impractical to delete electronic copies of personal data, CY will put it beyond operational use. It should be noted that CY allows up to 3 months after the end of the schedule to complete the action.
CY maintains a website for publicity purposes and as a source of information for anyone who is taking an interest in the services offered. The website uses cookies to enhance user experience and to collect analytical data of the web browsers used to view the website. User consent is sought before non-essential cookies are run. No attempt is made to identify the individuals, via technical means or otherwise, that visit the website, unless there is a legal requirement to do so.
The UK General Data Protection Regulation (GDPR) defines the rights although these do not apply in all situations. For convenience, these rights are shown below:
- Right to be informed as to how your personal data are being processed – this is done through this notice
- Right to access your personal data held by CY which is done by submitting a ‘Subject Access Request’ (SAR) to the privacy manager
- Right to rectification of your personal data if CY has collected it incorrectly or it needs to be updated
- Right to erasure of your personal data for which CY no longer has a legitimate purpose to process
- Right to restrict processing under certain circumstances, during which time your personal data will be put out of operational use until the related matter is resolved
- Right to data portability of your personal data in a machine-readable version, but this only applies to data provided with consent or under contract
- Right to object to processing your personal data for which CY does not have a legal or contractual obligation
- Rights related to automated decision making and profiling, however CY does not use these techniques in its decision making
Further details on data subject rights can be found on the Information Commissioner’s Office (ICO) website: https://ico.org.uk.
Raising concerns, exercising rights, or making queries about our processing of your personal data can be done by contacting the privacy manager. Please be aware that CY will need to verify a requesters/enquirer’s identity before responding fully. For that reason, you may be asked for proof of identification that, in context, will enable CY to confirm your identity. Alternatively, you may contact the ICO directly, using the details provided above.
December 2024