Introduction
Your privacy is very important to us. We are committed to being transparent about how we collect and use all personal data, and to meeting our data protection obligations in line with the UK General Data Protection Regulation and the Data Protection Act 2018.
This Privacy Policy explains how we collect, use, store, share and protect personal information, your rights and how to contact us.
This Privacy Policy explains how we collect, use, store, share and protect personal information, your rights and how to contact us.
Who we are and how to contact us
The Duchy of Cornwall is a private estate founded in 1337.
The Secretary and Keeper of the Records of the Duchy of Cornwall is the registered data controller (reference number Z8335723) responsible for the processing of personal information.
If you want to exercise your personal data rights including your statutory right to complain about how your data has been handled, or if you have any questions please contact us at:
Head of Archives and Information Rights
Duchy of Cornwall
10 Buckingham Gate
SW1E 6LA
Email: [email protected]
Contact details for all Duchy of Cornwall Offices can be found on our website here.
The Secretary and Keeper of the Records of the Duchy of Cornwall is the registered data controller (reference number Z8335723) responsible for the processing of personal information.
If you want to exercise your personal data rights including your statutory right to complain about how your data has been handled, or if you have any questions please contact us at:
Head of Archives and Information Rights
Duchy of Cornwall
10 Buckingham Gate
SW1E 6LA
Email: [email protected]
Contact details for all Duchy of Cornwall Offices can be found on our website here.
How we handle complaints
Any complaints must be sent to us first and we will acknowledge these within 30 days and investigate without undue delay. We will keep you informed of progress and any outcomes. If your complaint is unresolved you can complain to the ICO through their website: https://ico.org.uk/concerns/ or their helpline on 0303 123 1113, or in writing to: ICO, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
Information we collect about you
Depending on our relationship with you, we may collect:
- Name and contact details.
- Postal address.
- Email address and telephone number.
- Property, tenancy or lease information.
- Financial and payment information.
- Employment and recruitment information.
- Correspondence and enquiry records.
- CCTV images and security records.
- Website usage information.
Where necessary and lawful, we may process special category personal data, such as health information, in accordance with data protection legislation.
- Name and contact details.
- Postal address.
- Email address and telephone number.
- Property, tenancy or lease information.
- Financial and payment information.
- Employment and recruitment information.
- Correspondence and enquiry records.
- CCTV images and security records.
- Website usage information.
Where necessary and lawful, we may process special category personal data, such as health information, in accordance with data protection legislation.
How we collect information from you
We collect personal information when you:
- Contact us by email, telephone, post or through our website.
- Apply for a job with us.
- Become a tenant, occupier, leaseholder or customer.
- Attend an event organised by us.
- Supply goods or services to us.
- Visit our premises or estate locations where security measures such as CCTV are in operation.
- Use our website.
We may also receive information from professional advisers, public authorities, agents, contractors and publicly available sources where this is lawful and appropriate.
- Contact us by email, telephone, post or through our website.
- Apply for a job with us.
- Become a tenant, occupier, leaseholder or customer.
- Attend an event organised by us.
- Supply goods or services to us.
- Visit our premises or estate locations where security measures such as CCTV are in operation.
- Use our website.
We may also receive information from professional advisers, public authorities, agents, contractors and publicly available sources where this is lawful and appropriate.
Why we collect personal information
We process personal information under one or more of the following lawful bases:
- Performance of a contract.
- Compliance with a legal obligation.
- Legitimate interests pursued by the Duchy.
- Consent, where required.
- Employment and social protection obligations.
- Establishment, exercise or defence of legal claims.
Where we rely on legitimate interests, we ensure that your rights and freedoms are properly considered and protected.
- Performance of a contract.
- Compliance with a legal obligation.
- Legitimate interests pursued by the Duchy.
- Consent, where required.
- Employment and social protection obligations.
- Establishment, exercise or defence of legal claims.
Where we rely on legitimate interests, we ensure that your rights and freedoms are properly considered and protected.
How we use your information
We use personal information to:
- Manage the Duchy's estates, properties and landholdings.
- Administer tenancies, licences and leases.
- Respond to enquiries and correspondence.
- Manage contracts and supplier relationships.
- Recruit and manage employees.
- Organise and administer events.
- Maintain safety and security.
- Protect our legal rights and interests.
- Comply with legal and regulatory obligations.
- Improve our services and website.
- Manage the Duchy's estates, properties and landholdings.
- Administer tenancies, licences and leases.
- Respond to enquiries and correspondence.
- Manage contracts and supplier relationships.
- Recruit and manage employees.
- Organise and administer events.
- Maintain safety and security.
- Protect our legal rights and interests.
- Comply with legal and regulatory obligations.
- Improve our services and website.
Who we pass information to
We may share personal information with:
- Professional advisers, including legal advisers, auditors and insurers.
- Service providers acting on our behalf.
- Property managers and contractors.
- Financial institutions.
- Regulatory bodies and public authorities.
- Law enforcement agencies where required by law.
Where personal information is transferred outside the United Kingdom, we will ensure that appropriate safeguards are in place to protect it in accordance with UK GDPR requirements, and we will only do this where there is an appropriate lawful basis.
- Professional advisers, including legal advisers, auditors and insurers.
- Service providers acting on our behalf.
- Property managers and contractors.
- Financial institutions.
- Regulatory bodies and public authorities.
- Law enforcement agencies where required by law.
Where personal information is transferred outside the United Kingdom, we will ensure that appropriate safeguards are in place to protect it in accordance with UK GDPR requirements, and we will only do this where there is an appropriate lawful basis.
How we protect your data
We take the security of your data seriously. We have internal policies and controls in place to ensure that your data is not lost, accidentally destroyed, misused or disclosed, and is not accessed except by our employees in the performance of their duties. These include access controls, encryption where appropriate and secure storage systems.
Where we engage third parties to process personal data on our behalf, they do so on the basis of written instructions, are under a duty of confidentiality and are obliged to implement appropriate technical and organisational measures to ensure the security of data.
Where we engage third parties to process personal data on our behalf, they do so on the basis of written instructions, are under a duty of confidentiality and are obliged to implement appropriate technical and organisational measures to ensure the security of data.
How long we keep your data
We retain personal information only for as long as necessary for the purposes for which it was collected, including meeting legal, regulatory and business requirements. Retention periods are determined by our retention schedules. Information that is no longer required is securely deleted, destroyed or anonymised.
Your rights
As a data subject, under UK data protection law you have a number of rights. You can:
- access and obtain a copy of your personal data on request;
- ask us to correct incorrect or incomplete data;
- ask us to delete or stop processing your personal data, for example where the data is no longer necessary for the purposes of processing;
- object to the processing of your data based on grounds relating to your specific situation and limit our use of your personal data in limited circumstances;
- to receive from us the personal data we hold about you which you have provided to us, in a reasonable format specified by you, for the purpose of you transmitting that data to another data controller (data portability); and
- where our processing is based on your consent, you may withdraw that consent, without affecting the lawfulness of our processing based on consent before its withdrawal.
Please note that none of these rights are absolute and we may be entitled to refuse requests where exceptions apply.
- access and obtain a copy of your personal data on request;
- ask us to correct incorrect or incomplete data;
- ask us to delete or stop processing your personal data, for example where the data is no longer necessary for the purposes of processing;
- object to the processing of your data based on grounds relating to your specific situation and limit our use of your personal data in limited circumstances;
- to receive from us the personal data we hold about you which you have provided to us, in a reasonable format specified by you, for the purpose of you transmitting that data to another data controller (data portability); and
- where our processing is based on your consent, you may withdraw that consent, without affecting the lawfulness of our processing based on consent before its withdrawal.
Please note that none of these rights are absolute and we may be entitled to refuse requests where exceptions apply.
Further information
For more detailed information you can request a copy of our Privacy Notices.