How we use and store your information
When you supply any personal information to the National Park Authority we have some legal obligations in the way we deal with it.
We must collect the information fairly – for example, we must explain how we will use it, and we have to tell you if we want to pass the information on to anyone else. As long as we hold your information we will treat it in accordance with this statement and data protection law.
Why we collect and use your information
Broadly speaking, we hold individuals’ contact and other information in order to help us to achieve our key purposes of conservation and enhancement, as well as our socio-economic duty. There are also more specific reasons why we need to use your information, and these vary depending on the service or project in question.
We collect information from individuals in these categories, among others:
- Users of the planning service
- People who complain about enforcement matters, and people who own the relevant sites
- Other users of particular services, such as people interested in the work of the New Forest Land Advice Service, people complaining or asking for information, and those who subscribe to newsletters
- Volunteers
- People who use our website (see ‘cookies’ section)
- Parish Councillors
- Job applicants, employees and Members
- People who work for other stakeholders in the New Forest who contact us, such as employees of Forestry England or New Forest District Council
- People who use and respond to our social media pages and posts
- People we meet at our outreach events, including the work we do with schools, at the New Forest Show or in connection with particular projects
- People who fill in surveys and consultations.
You will see from this list that in some cases we need your contact information so that we can provide you with services or information that you have requested, such as planning applications or information requests. In some cases we might need some information that goes beyond your contact details – for example, if you are making a planning application we might need some information on how you use or intend to use your home. There may also be times we ask for this sort of information in a formal capacity – for example, during an enforcement investigation we might issue a Planning Contravention Notice. Where we need to use your information for reasons of this type (so that you can access a service or so that you can respond to an investigation), we will not ask you for consent to collect and use your information. This is because we have to use it in our capacity as the local planning authority or because we have another good reason why we need to use your information.
There may also be times that we do not actually need your contact information but we would like to use it in order to keep you informed about and/or invite you to participate in events and services that might interest you. Occasionally we would also like to collect information from you that goes beyond just your contact details – for example, your volunteering interests or your availability. In all these circumstances we will let you know that that is how your information will be used when we collect it from you, and we will usually ask you for your consent for this although there will be times when the law allows us to use your information without consent.
Your rights
In both cases outlined above, you can ask us to stop holding and using your information and we will consider your request carefully and let you know what we decide. Unless there is a good reason why we need to continue using your information (for example, that you have recently made or responded to a planning application) we will immediately delete it from our database. You can ask us to amend or delete your information by contacting our Information and Data Protection Officer:
Information and Data Protection Officer
New Forest National Park Authority
Lymington Town Hall
Avenue Road
Lymington
Hampshire
SO41 9ZG
T: 01590 646653
E: dpo@newforestnpa.gov.uk
You also have the right to request a copy of the personal information that we hold about you, to ask us to amend it, or to ask us to restrict the ways in which we process it. If you have given your consent to our use of your information you can withdraw this at any time you like. If you would like to do so, or you require further guidance or information on any of your data protection rights, please contact the Information and Data Protection Officer.
You can find further information about some of your rights visit the Information Information Commissioner’s Office.
How we collect and hold your information
Information can be collected by way of the website, social media, through specific forms, at our offices, by phone or email, or at events.
We take your privacy very seriously. Your information will never be supplied to anyone outside the NPA without first obtaining your consent or letting you know as appropriate, unless we are obliged by law to disclose it, or it would otherwise be fair to do so and we are permitted by law to use it in this way. An example of when we might be legally obliged to disclose your data would be if the police ask to see some information to help them to solve a crime or to protect someone. An example of where it might otherwise be lawful for us to disclose your data would be if someone made a request for information under the Freedom of Information Act. In these circumstances we would carefully consider whether it would be appropriate and fair to disclose your data, including factors such as what we think you might expect us to do with your data and whether you have consented to its release.
If we would like to share your information with third parties for reasons such as that it would be useful to us or them – for example, sharing with other stakeholders on a joint project, or with planning consultants, or with bodies to which we might outsource types of administration such as payroll – we will always let you know, and we will usually ask you for your consent.
We are especially keen to ensure that children’s information, and the information of anyone with special circumstances, is processed safely. If you are aged 16 or under, please get your parent or guardian’s permission before you provide personal information to us. If for some reason you need to supply us with sensitive types of information – for example, relating to health, disability or politics – please clearly label your correspondence so that we can make sure we look after it properly.
Whatever your circumstances we will hold any personal information securely. We use Microsoft Office 365 servers which are in the Republic of Ireland. This means that your information is held outside the UK, but it is not accessible to anyone other than to our staff and Microsoft. For more information about cookies, which are processed by Google Analytics in the USA, please see the cookies section at the end of this policy.
We also share some information with our service providers, which includes other local authorities with which we have Service Level Agreements and other service providers, such as Campaign Monitor for our e-newsletter, but we will always let you know before we do this and obtain your consent if necessary.
We will hold your personal information on our systems for as long as you use the service you have requested or until any consents expire, as applicable, and we will remove it in the event that the purpose for collecting it has been met, unless we are required by law to retain it for a longer period. We regularly review the information we hold to make sure that it is still relevant, to ensure that we have a genuine reason to process it, and to review the impact on you of our use of your information. We have a records retention schedule and this also specifies how long certain types of personal information are generally kept.
We will not use your information for electronic marketing except in compliance with data protection law and the laws on electronic marketing. We will never sell your personal information to anyone. We don’t use automated decision making to determine whether or not to supply services or information to you. If we have collected and use your information for one particular purpose and later we would like to use it for a different one we will let you know, and we will ask you for your consent.
For more details on how we collect and hold your information, please contact the Information and Data Protection Officer.
The technical bit, and how to raise concerns
The EU General Data Protection Regulation (GDPR) and the UK Data Protection Act 2018 govern how we hold your information. Other relevant laws include the Freedom of Information Act, the Environmental Information Regulations and the laws on electronic marketing, all as updated from time to time. You can find out more about the legal basis we rely on to process your information (Article 6 of the GPDR) from the Information and Data Protection Officer.
The way that all organisations comply with these laws is overseen in the UK by the Information Commissioner’s Office (ICO). If you have any concerns about how we handle your information you can contact the ICO at: First Contact Team, Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, SK9 5AF. You can also find further guidance on their website here: www.ico.org.uk.has
