Our Privacy Notice
We regularly update our Privacy Notice; it was last updated on Monday 27 March 2023.
When we use your personal data,City of York Council comply with UK data protection legislation, and is the registered ‘controller’. Our data protection notification is registered with the Information Commissioner’s Office (ICO), reference: Z5809563.
To make it clear how we collect and use your personal data, and to help you understand your rights, we've divided our Privacy Notice into the following areas:
- personal data
- collecting personal data
- using your personal data
- lawful basis for processing your personal data
- sharing personal data
- overseas transfers of personal data
- retaining personal data
- further processing of personal data
- your rights relating to personal data
'Personal data' is any information that relates to an identifiable living person; whether they are identified directly or indirectly by reference to a name, identification number, location data, an online identifier or to one or more factors specific to their physical, physiological, genetic, mental, economic, cultural or social identity.
For the purposes of data protection legislation, the term 'personal data' also includes:
- personal information that has been pseudonymised or key-coded (depending on how difficult it is to attribute the pseudonym to an individual)
- genetic data and biometric data where processed to uniquely identify an individual ('sensitive personal data' or 'special categories of personal data')
Collecting personal data
When we collect your personal data we will:
- ensure you know why we need it
- only ask for what is necessary for the service we're providing to you
- protect it and make sure nobody has access to it who shouldn’t
- ensure you know if you have a choice about giving us information
- make sure we don’t keep it for longer than is necessary
We ask that you give us accurate information, notify us of any mistakes, and tells us as soon as possible of any changes.
The information we will collect includes, but is not limited to:
- email address
- telephone number
Using personal data
The information we ask you to provide and how we will use it, will depend on what service or information you are asking for. This will include when you:
- register for a York by Bus smartcard
- ask about your travel options
- make other enquiries
Lawful basis for processing your personal data
Depending on the processing activity, we rely on the following lawful basis for processing your personal data under the UK GDPR:
- Article 6(1)(a) – your explicit consent
- Article 6(1)(b) which relates to processing necessary for the performance of a contract
- Article 6(1)(c) so we can comply with our legal obligations
- Article 6(1)(e) for the performance of our public task
- Article 6(1)(f) for the purposes of our legitimate interest
Where the information we process is special category data, for example your health data, the additional bases for processing that we rely on are:
- Article 9(2)(a) your explicit consent
- Article 9(2)(b) which relates to carrying out our obligations and exercising our rights
- Article 9(2)(g) – where processing is necessary for reasons of substantial public interest
- Article 9(2)(j) for archiving purposes in the public interest
In addition we rely on the processing condition at Schedule 1 part 1 paragraph 1 of the DPA 2018. This relates to the processing of special category data for employment purposes.
Our Appropriate Policy Document provides further information about this processing.
Where we ask for your explicit consent, we will ensure you are also told how you can withdraw your consent
Sharing personal data
www.itravelyork.info is a service provided by City of York Council and we will only share your information with other council services as appropriate.
We will not share your details with any other third parties aside from the following exception:
- if you ask a question about Park & Ride, your name and email address will be shared with First York Ltd, the operator of York Park & Ride
We may also be required or permitted, under data protection legislation, to disclose your personal data without your explicit consent, e.g. if we have a legal obligation to do so, such as law enforcement, fraud or tax investigations, regulation and licensing, criminal prosecutions and court proceedings.
Overseas transfers of personal data
We don’t routinely transfer personal data overseas but when this is necessary, we ensure that we have appropriate safeguards in place.
Retaining personal data
We will keep your information securely on the council’s secure network and only for as long as necessary to provide you with the service you have requested and then we will securely and confidentially delete or destroy it.
Where required or appropriate to, at the end of the retention period, we will pass onto the City Archives any relevant information.
Further processing of personal data
If we wish to use your personal data for a new purpose, not covered by this Privacy Notice, then we'll provide you with a new notice. The new notice will:
- explain this new use before we start the processing
- set out the relevant purposes and processing conditions
Where and whenever necessary, we'll seek your consent to the new processing, if we start to use your personal data for a purpose not mentioned in this Privacy Notice.
To find out about your rights under Data Protection law, see the Information Commissioners Office (ICO).
You can also find information about your rights in Our Privacy Notice.
If you have any questions about this Privacy Notice, want to exercise your rights, or if you have a complaint about how your information has been used, please contact us by email: firstname.lastname@example.org or telephone: 01904 554145, or write to :
Data Protection Officer
City of York Council
By using our website you are consenting to certain types of cookie being placed on your device. See our Cookies Policy.
Where our website links to external resources or websites, these may add their own cookies. These are outside our control. Cookies can be disabled by changing the settings in your browser, but you may need to re-enter information at times.