We are York Conservation Trust Limited. We are both a company registered in England and Wales with registration number 395954 and a charity having Charity Commission registration number 505302. Our registered address is De Grey House, St Leonard's Place, York, United Kingdom, YO1 7HE. We are a data controller for the purpose of the Data Protection Act 2018, the UK General Data Protection Regulation (the “UK GDPR”) and all associated laws applicable in England and Wales, including the Privacy and Electronic Communications (EC Directive) Regulations 2013 (the “Data Protection Laws”).
Our principal purpose is the stewardship of buildings of historic significance and cultural interest in the City of York. We do this by acquiring the freehold of buildings, carrying out programmes of refurbishment and generating income to support ongoing repair and maintenance costs by letting the properties to either businesses or non-business tenants. We own some of York’s finest buildings which are used extensively by the general public as customers of our tenants. We also administer a website available at www.yorkconservationtrust.org (the “Website”).
This Privacy Notice outlines the way in which in which information relating to you is gathered and used by York Conservation Trust (referred to in this policy as ‘we’, ‘our’ or ‘us’).
In this Privacy Notice we seek to abide by the letter and spirit of the guidelines laid out by the Information Commissioners Office (“ICO”) on their webpage on the ‘Right to be Informed’.
We may collect your data in a number of ways and most often this will be directly from you. This will usually happen in the following ways:
We may sometimes collect information about you from third parties; for example, from referees, past employers, credit agencies or other professional persons.
Currently, the Website offers no transactional functions through which your data may be provided to us. The principal purpose of the Website is to provide you and other members of the public with information about our historic properties and information about us. For the foreseeable future, we have no intention to change this or incorporate a trading function into the Website.
We may occasionally modify our Privacy Notice and/or Cookies Policy and will post those changes on the Website so do please check it regularly. We will notify you of any changes made to our Privacy Notice either a notification on our website.
Information automatically collected online
Our Website does not facilitate the establishment of a commercial relationship between you and us. Its purpose is to provide information to the general public and to allow members of the public to contact us should they wish to do so.
We may collect anonymous information about your visit to the Website e.g. the URL you came from, your device type, operating system your browser type. We may also collect information about the country where your computer is located, the pages of our Website that were viewed during your visit, any search terms that you entered on our Website and other technology on the devices you use to access the Website.
Information collected from prospective tenants
If you express an interest in leasing one of our properties either directly to us or indirectly through an approved agent of ours, we, or they will request personal data and use this in assessing the suitability or otherwise of our standard lease terms and conditions to meet your needs. This information may include any or all of the following; name, address, employer’s reference, current landlord’s reference, bank reference, passport details, driving licence details, bank statements, business plan, credit reference and any other relevant information that may be specific to the nature of the lease in which you have expressed an interest.
Information collected from tenants
If we establish a contractual relationship with you through a lease then you will appear in our business records as a tenant and we will maintain an up to date record of your tenancy including rents invoiced or otherwise due, rechargeable insurance premiums and any other legitimate fees or charges that may arise from time to time. We will simultaneously maintain an accurate record of all monies paid by or transferred to us from you.
Our record may also include details of any outstanding monies due from time to time and any appropriate correspondence with you regarding outstanding obligations.
The records will also include information on the property itself including common parts where applicable. Such records may cover condition, repairs, maintenance, damages, dilapidations, services, fire and safety information and any relevant points you may bring to our attention regarding any or all of these during the period of your tenancy.
Information collected from members of the general public
We welcome and wish to encourage public interest in our work and in our properties. If you contact us via telephone, in person, email or via the contact us section on the Website, then we will retain a record of your name, address, telephone number, email address and any other information relevant to the nature of your enquiry.
We may be able to satisfy your enquiry quickly and have no need to retain your personal data and will therefore securely dispose of your personal data at this stage. In other cases, we may retain the information in order to satisfy your enquiry more fully at a later date but will not retain this information for longer than 12 months. Your personal data will not be provided to third parties unless and in exceptional circumstances where the law requires to do so.
Miscellaneous other contact
Sometimes, when you contact us by telephone, post or email, including for feedback, a record will be created of exchange of information.
We will never ask you for any Special Categories of Personal Data (as defined in the Data Protection Laws).
We require the information to understand your needs or interest in our properties and to provide a pleasant and straightforward service to our customers and the general public. In particular we may use your information for the following reasons;
Administrative Purposes
In the course of business
We owe contractual duties to our prospective and tenant customers, to provide direct landlord services and procure the provision of indirect agent or trade services during and beyond the course of their relationship with us.
Staff and volunteers
We owe contractual and legal duties to those we engage to deliver our services including payroll, pension, benefits, trade and credit references. In rare cases this may involve the processing of special category data or criminal convictions information under legal duties place on us as employers including as regards diversity, safeguarding, health and welfare.
Communication (general)
In accordance with your preferences (please see below for more details about preferences including your right to object to general communications) we will use your details to send you:
We consider that we have a legitimate interest to send this type of material to you and that (absent of any specific wishes to the contrary that you notify to us) you will reasonably expect us to do this. However, except where directly solicited, which will include where expected as part of our ongoing contractual arrangement, messages will only be sent electronically where you have;
General, legal and regulatory uses
We confirm that any personal data that you provide to us (or which, exceptionally, is available on public registers) and any data from which we can identify you will only be stored and processed in accordance with Data Protection Law.
While we may from time to time collect data from around the world, in our usual course of operations we will not transfer any personal data we collect to anywhere outside the EEA.
We will not generally either collect personal data about you from publicly available sources, nor disclose your personal data to third parties, except where there is a lawful and legitimate reason for doing so.
In the unlikely event that the business and activity of York Conservation Trust are transferred to or integrated with those of another charitable entity, your details may be disclosed to our advisors and to any transferee of the business and activity.
Each lawful basis for processing personal data is set out in Article 6 of the UK GDPR. We may process your personal data on more than one lawful basis depending on the specific purpose for which we are using your data. Please contact us if you need details about the specific legal basis we are relying on to process your personal data where more than one basis has been set out below. At least one of these must apply whenever we process personal data:
Consent:you have given clear consent for us to process your personal data for a specific purpose for example when you contact us and give us your permission to contact you back and keep you updated;
Contract: the processing is necessary for a contract we have with you (for example, to process and deliver services to you and to manage our relationship with you), or because you have asked us to take specific steps before entering into a contract. This will include when we contract with you for the lease of one of our properties;
Legal obligation: the processing is necessary for us to comply with a legal or regulatory obligation (not including contractual obligations). For example, if we are required to share information to a local authority, HMRC or the Police;
Legitimate interests: the processing is necessary for our legitimate interests (for example to administer and maintain our Website) or the legitimate interests of a third party unless there is a good reason to protect your personal data which overrides those legitimate interests. We make sure we consider and balance any potential impact on you (both positive and negative) and your rights before we process your personal data for our legitimate interests. We do not use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law).
Click here to find out more on the ICO’s website about the types of lawful basis that we will rely on to process your personal data.
Individuals have various rights under Data Protection Law to access and understand personal data about them from data controllers, and in some cases ask for it to be erased or amended or no longer processed, but subject to certain exceptions and limitations. Please click on the links below to access the Information Commissioner’s Office website to find out more about these rights:
If you wish to exercise any of the rights set out above, please contact us. If you are unhappy with how we are processing your personal data, you have the right to complaint to the ICO. The Information Commissioner can be contacted at:
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.
We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.
We will retain personal data securely and only in line with how long it is necessary to keep for a legitimate and lawful reason and in accordance with our retention policies.
For example:
We consider such retention periods to be necessary for, and consistent with, the purposes for which the personal data was collected.
If you have any specific queries about how our retention policy is applied (or wish to request that personal data that you no longer believe to be relevant is considered for erasure), please contact us directly. However, we ask you to bear in mind that we may have lawful and necessary reasons to hold on to some personal data even following such request.
We may have to share your personal data with the parties below in order to provide our services to you. We require all third parties to respect the security of your personal data and to treat it in accordance with the law, and when they are processing personal data on our behalf we do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions and in accordance with the law.
Examples of our third parties include:
General enquiries regarding this Privacy Notice, or our Cookies Policy, should be directed to:
Privacy / Cookies Enquiries
York Conservation Trust
De Grey House
York
YO1 7HE
Email: privacydata@yorkconservationtrust.org
We do not have a Data Protection Officer within the meaning of Data Protection Law, but our staff dealing with requests will have relevant training and be able to respond to your enquiry.
If you believe that we have not complied with this Privacy Notice or acted otherwise than in accordance with Data Protection Law, you should first notify us directly. You can also make a referral to or lodge a complaint with the ICO although the ICO recommends that steps are taken to resolve the matter with the data controller directly before involving the regulator.
3rd November 2023
