Privacy & Cookies

Under UK data protection law, you have the following rights. Some rights are subject to limitations (for example, safeguarding or legal obligations) and may not always apply. If we cannot fulfil a request, we will explain why.

• Right to be informed – to know how your data is used.
• Right of access – to request a copy of your personal data.
• Right to rectification – to correct inaccurate or incomplete data.
• Right to erasure – to request deletion where legally permitted.
• Right to restrict processing – to limit how we use your data in certain circumstances.
• Right to data portability – to receive certain data in a structured, machine‑readable format.
• Right to object – to processing based on legitimate interests or for direct marketing.
• Rights around automated decision‑making – we do not make decisions that produce legal or similarly significant effects solely by automated means.
• Right to complain- to complain against any of our activities.

Where personal data is transferred outside the UK, we put in place appropriate safeguards such as the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, and we perform transfer risk assessments where required.

We retain personal data only for as long as necessary to fulfil the purposes set out in this Notice and to meet legal, regulatory, contractual and funder requirements. Specific retention periods are set out in Letchworth’s Retention Schedule and may vary by project (for example, safeguarding records or research evaluation data). We will provide further information on request.

We use appropriate technical and organisational measures to protect personal data, including access controls, encryption in transit and at rest (where appropriate), data minimisation, secure deletion, staff training, confidentiality agreements, and vendor due diligence. We regularly review and improve these measures.

We work directly with children, young people and families. Where we rely on consent or legitimate interest, we take account of the child’s age and understanding. For online services, consent from a holder of parental responsibility is usually required for children under 13. For offline, face‑to‑face services, we consider the child’s competence to consent and may also seek parental or guardian consent where appropriate. We always act in the child’s best interests and in line with safeguarding duties.

We may also rely on legitimate interest, based on the activity.

This appendix covers how Letchworth processes personal data related to tenants, leaseholders, managing agents and individuals involved in property or tenancy arrangements.

At Letchworth, we engage in providing unfurnished houses and residential flats in Letchworth Garden City for rent.

What Personal Data We Collect

We only collect the minimum data necessary for each purpose, this includes:

• Identity and contact data – name, date of birth/age, gender, address/postcode, email, phone, preferred contact method, contact details, salary information, and the right to live and work information
• Property and tenancy information, including lease arrangements, tenancy arrangements and payment details
• Communications and correspondence relating to tenancy, redevelopment, maintenance, compliance, or estate management matters.
• Information relating to agents, subcontractors, or representatives acting on behalf of tenants or leaseholders.

Where We Get Your Data From

We collect your information in several channels, some of which include:

• When you apply by filling out our forms to live in our residences
• When we receive your information from third parties, such as Zoopla, Rightmove or other third-party platforms.
• If we engage in background checks to assess your application
• When you become a tenant, we will process information about you under the contract of tenancy.
• From third-party agents or advisers acting on behalf of tenants or organisations where appropriate.
• For any instances of complaints, maintenance, information around bills and tenancy related records.

How We Use Your Data

We use your information in only for specific purposes, which mainly include

• To manage tenancy, leasehold, and contractual relationships
• To administer property management, maintenance, and estate management activities.
• To communicate with tenants, leaseholders, agents, and contractors regarding property matters.
• To manage applications and any permission requests
• To maintain records relating to leases and tenancy arrangements.
• To protect the safety, security, and proper management of properties
• To investigate complaints, disputes, breaches of lease conditions, or legal claims.

Our Lawful Bases (Article 6 UK GDPR)

As required under the UK GDPR, we identify a lawful basis to process your personal data.

• To process successful applications, we rely on Contractual Obligation as the primary lawful basis due to the nature of relationship with the tenant.
• To process any information relating to unsuccessful applicants, we rely on legitimate interest.
• To manage any concerns, complaints, repairs, maintenance, or any other issues, we rely Contractual Obligation.

Special Category Data (Article 9 UK GDPR)

We don’t usually process any special categories of data in such activities. We may process information around your gender based on your consent, or on substantial public interest, read with statutory and government purposes for processing any nationality or right to work related information.

Who We Share Data With

We will not share your information with any third parties unless there is a legitimate reason to share this information. Some of the parties we share your information with include:

• We have any agency acting on our behalf
• We carry out background checks for your application.

This appendix explains how Letchworth processes personal data relating to Heritage and Stewardship services, planning requests, and property alteration applications. As part of our Heritage and Stewardship activities, guidance is provided to homeowners to help preserve the town’s unique character. This includes providing the Design Principles to advise on design requirements for the two-character areas – Heritage and Modern.

What Personal Data We Collect

We only collect the minimum data necessary for each purpose, this includes:

• Identity and contact data – name, email, phone, preferred contact method and contact details
• Information about your property – address
• Information about the agent/architect – name, address, email, phone
• Information about your application – details of the proposed works (drawings, photographs and supporting documents)
• Historic records relating to previous applications, such as landlord consent applications

Where We Get Your Data From

We get your data from the following channels:

• When you check to see if your home classifies under the Character Area before you make an application
• Directly from you, when you apply by filing out our application form to make alterations to your home or to remove a tree/hedge
• When you contact us by email, phone or through the website for enquires
• From third party agents or architect who is corresponding with us on your behalf
• If we carry out a further consultation, we may collect data from your neighbours or from the Local Planning Authorities

How We Use Your Data

We use your information in only for specific purposes, which mainly include

• To assess your application on making alterations to your home
• To review proposed property alterations and developments
• To communicate with you or agents on your behalf
• To maintain records relating to applications, approvals, refusals and historic property alterations
• To protect the heritage character and appearance of the property
• To assess your application form on removing a tree or hedge

Our Lawful Bases (Article 6 UK GDPR)

As required under the UK GDPR, we identify a lawful basis to process your personal data.

• To process your application and assess the changes requested by you, we use legitimate interest as our primary lawful basis.
• For applicants that have ownership under a Sub or under Lease, the Head of Lessee may be consulted and therefore contractual obligation or legal obligation will be the lawful basis.

Special Category Data (Article 9 UK GDPR)

We don’t usually process any special categories of data for Heritage and Stewardship

Who We Share Data With

We will not share your information with any third parties unless there is a legitimate reason to share this information. Some of the parties we share your information with include:

• Agents/architects acting on behalf of applicants
• Neighbours and Head Leases as part of the consultation process
• Local Planning Authorities if further consultation is required

This appendix covers how Letchworth processes personal data relating to community programmes, activities for participants, venue visits, ticket purchases, events and grant applications connected to our charitable and community activities.

Letchworth provides the community with a variety of activities and events which include arts and culture, outdoors nature activities and hands on activities.

What Personal Data We Collect

We only collect the minimum data necessary for each purpose. Depending on the activity, we may collect:

• Identity and contact data – name, date of birth/age, gender, address/postcode, email, phone, preferred contact method, parent/guardian/carer contact details.
• Activity Participants and attendance records – bookings, registrations and ticket purchases
• Equality, diversity and inclusion (EDI) information – protected characteristic information
• Safeguarding information – disclosures or concerns, risk assessments, chronology/incident logs and safety plans
• Photographs/recordings – captures during events or activities with appropriate notices/permission
• Grant application information – the purpose of submitting a grant application, aims of what the grant will achieve, information on the charity the organisation may be working with, occupation of who will benefit from the grant
• Research and evaluation data – surveys, feedback, evaluations, and impact reporting used to improve activities, programmes, and grant-funded initiatives.

Where We Get Your Data From

We get your data from the following channels:

• Directly from participants, visitors, parent/guardian/carer or attendees through activity and event bookings
• When you contact us enquiring about an event or activity
• During events, activities or venue attendance
• Directly from the organisation when emailing enquires regarding a grant application
• Directly from the organisation when emailing us a grant application

How We Use Your Data

We use your information in only for specific purposes, which mainly include

• To manage enquires and provide information about available services.
• To register you for and deliver programmes and services.
• To administer and deliver events, programmes, activities, and community initiatives.
• To process bookings, registrations, ticket purchases, and attendance.
• To assess and manage grant applications
• To support accessibility, safeguarding, wellbeing, health, and safety requirements.
• To evaluate, improve our programmes, activities, services, and to report on the impact it has on the community

Our Lawful Bases (Article 6 UK GDPR)

As required under the UK GDPR, we identify a lawful basis to process your personal data.

• To process data on the participants, we rely on Legitimate Interest as the primary lawful basis. For any visitors paying for any ticketed activities, we rely on contractual obligation
• For recordings/photography for the event and activities, consent would be used as the lawful basis
• For safeguarding reasons, Vital Interests will be used as processing is necessary to protect someone’s life or prevent serious harm
• To process data on the grant application, we rely on Legitimate Interest to assess the grant request

Special Category Data (Article 9 UK GDPR)

Where we process special category data, we do so only where strictly necessary and with additional safeguards. Our typical conditions include:

• To process dietary requirements and other optional EDI information, we use Explicit Consent. Where we collect EDI information for equal opportunities monitoring, we rely on Substantial Public Interest
• To process data on individuals who are incapable of giving consent during an emergency, we use Vital Interest
• For safeguarding of children at the events and the activities, we use Substantial Public Interest, read with Safeguarding of children and of individuals at risk
• For safeguarding reasons, Vital Interests will be used as processing is necessary to protect someone’s life or

Who We Share Data With

We will not share your information with any third parties unless there is a legitimate reason to share this information. Some of the parties we share your information with include:

• Venues, ticketing providers and event management providers supporting our activities and events
• Service providers supporting registrations

This appendix covers how Letchworth processes personal data relating to electors of Governors and Governor candidates. Letchworth has 30 Governors who represent the community, help with future strategies and hold the community accountable. The governor is appointed through elections by postal ballots (registered electors in the SG6 postcode area) from the public, clubs, societies and groups and they are also appointed by the Board of Management.

What Personal Data We Collect

We only collect the minimum data necessary for each purpose, this includes:

• For public electors – name, contact information, residential address and voting record
• For the club, society or group - Data of group: Full name of group, main address, purpose of group, current membership, data group formed, group website, category of group. Data of person filling out form: title, name, position, address, postcode, telephone and email.
• For governor recruitment – name, date of birth, address/postcode, email, phone, preferred contact method and contact details, CV and covering letter

Where We Get Your Data From

We collect your information in several channels, some of which include:

• When you apply as a club, society or a group by filling out a form
• When you vote, we obtain your data from the Register of Electors (maintained by the Electoral Registration Officer)
• When you apply as a Governor nominee by filling out an application form
• From referees for prospective Governors
• If we engage in background checks to assess your application

How We Use Your Data

We use your information in only for specific purposes, which mainly include

• To assess nominations and application for the Governor positions
• To review the candidate’s skills and experience for the position
• To maintain governance and appointment records
• To communicate with electors, candidates, clubs, societies and groups involved in the election process
• To handle any election enquires
• To publish election results and where appropriate, names and profiles of the appointed Governor

Our Lawful Bases (Article 6 UK GDPR)

As required under the UK GDPR, we identify a lawful basis to process your personal data.

• To administer elections, assess candidates and appointment Governors, we rely on Legitimate Interest as the primary lawful basis
• To comply with election obligations, we reply on legal obligation as our lawful basis

Special Category Data (Article 9 UK GDPR)

Where we process special category data or criminal offence data, we do so only where strictly necessary and with additional safeguards. Our typical conditions include:

• For Equal Opportunities for nominations - Art 9(2)(g) Substantial Public Interest, read with equality of opportunity and treatment
• For the process of elections - Art 9(2)(g) Substantial Public Interest read with Statutory etc and government processes
• Criminal offence data – Art 9(2)(g) Substantial Public Interest, handled in line with law and safeguarding or prevention of crime (e.g., DBS).

Who We Share Data With

We may share your personal data with third parties involved in administering Governor elections, appointments and governance processes, including Electoral Registration Officers, ballot administrators and mailing providers.

This appendix explains how we process personal data for job applicants, employees, workers, contractors, consultants and volunteers or trustees.

How We Collect Your Information

• Directly from you during recruitment and onboarding, and during your engagement with us.
• From agencies and referees (with your knowledge).
• From pre‑employment screening such as right‑to‑work and DBS where applicable.
• From internal systems (e.g., HR, payroll, learning and development).

What Personal Data We Collect

• Personal details and contact information.
• Application, CV and interview information; references; employment history and qualifications.
• Contract terms, job role, pay/fees, benefits, working time, leave and absence, performance and supervision records, disciplinary and grievance records, training records.
• Next of kin and emergency contacts.
• Right‑to‑work, DBS where applicable, and other compliance records.
• Special category data (where necessary) – health/occupational health information (e.g., reasonable adjustments), and equality, diversity and inclusion data provided voluntarily.

How We Use HR Data (Purposes and Lawful Bases)

• To recruit and onboard staff, volunteers and trustees – Contract (Art 6(1)(b)) and Legitimate Interests (Art 6(1)(f)).
• To administer employment/engagement – Contract (Art 6(1)(b)).
• To meet legal obligations – Legal Obligation (Art 6(1)(c)) (e.g., HMRC, right‑to‑work, health & safety).
• To manage performance, supervision, learning and development, security and IT systems – Legitimate Interests (Art 6(1)(f)).
• Special category data – Art 9(2)(b) employment and social protection law; Art 9(2)(g) substantial public interest (e.g., equality monitoring under Schedule 1 conditions); occupational health; and where appropriate, explicit consent.
• Criminal offence data – Art 9(2)(g) Substantial Public Interest, handled in line with law and safeguarding or prevention of crime (e.g., DBS).

Who We Share Your Data With

• Payroll, pension, HR and benefits providers (processors).
• Regulators and statutory bodies (e.g., HMRC, Home Office).
• Occupational health and wellbeing providers.
• IT service providers.
• Professional advisers and insurers where necessary.

This appendix explains how we process personal data for fundraising and marketing, including individual giving, corporate partnerships, trusts and foundations, events, and supporter communications and community engagement activities.

What We Collect

• Identity and contact data; communication preferences.
• Donation history, Gift Aid status, event registrations and attendance.
• Engagement information (e.g., email opens/clicks), where permitted.
• For trusts and corporate fundraising, publicly available information (e.g. from Companies House, the Charity Commission, press and your organisation’s website) to help us understand organisational interests, identify suitable partnership opportunities and maintain appropriate supporter relationships, in line with Legitimate Interests and your rights.
• Payment information processed securely by our payment service providers; we do not store full card details.

How We Use Supporter Data

• To process and acknowledge donations and manage Gift Aid.
• To manage events and volunteering opportunities.
• To send you marketing about our work and ways to support us, in line with your preferences and PECR.
• To develop supporter relationships, including segmentation and profiling to tailor messages, under Legitimate Interests; you can object at any time.
• To administer invitations, registrations and attendance for fundraising or community events
• To comply with legal and regulatory requirements and prevent fraud.

Lawful Bases (Fundraising & Marketing)

• Consent (Art 6(1)(a)) – for email marketing to individuals where required by PECR.
• Legitimate Interests (Art 6(1)(f)) – for postal marketing, or soft opt-in related email communications when you have expressed an interest
• Contract (Art 6(1)(b)) – to administer event bookings or benefits you have asked for.
• Legal Obligation (Art 6(1)(c)) – for Gift Aid and financial record‑keeping.

Who We Share Supporter Data With

• Payment processors and fundraising platforms (as independent controllers).
• Regulators (e.g., HMRC for Gift Aid) and auditors where required by law.
• Event partners and venues where necessary for attendance and safety.
• Trusted third party service providers who support our communications, CRM, marketing, and event administration systems

If you are unhappy with how we handle your personal data, you have the right to raise a complaint with us.

You can contact us by:

• Email: sofiya@hope-may.com

Please provide:

• Your name and contact details
• A clear description of your concern
• Any relevant dates or reference numbers

What Happens Next?

1. We will acknowledge your complaint within 30 days of receiving it.
2. We will investigate your concerns.
3. We may contact you if we need further information.
4. We will respond as soon as possible and without undue delay.

Our response will explain:

• What we have found
• Whether any action has been taken
• What happens next

If You Are Not Satisfied

If you remain unhappy with our response, you have the right to complain to the Information Commissioner’s Office (ICO):

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113
Website: https://ico.org.uk

Accessibility

If you require this information in an alternative format, please contact us and we will be happy to assist.