Privacy notice

This privacy notice is designed to help you understand how and why Buy Local processes your personal data. This notice should be read in conjunction with the Council’s Corporate Privacy Notice.

 

Who are we?

North Yorkshire Council is a ‘Data Controller’ as defined by Article 4(7) of the General Data Protection Regulation (GDPR).

This business directory has information about businesses and tradespeople open for business in North Yorkshire during the COVID-19 restrictions. The directory lets people know where to go locally for supplies and services during this difficult time.

Businesses and tradespeople who would like to make an entry to the directory must create an electronic account. This Privacy Notice informs users of those accounts about how and why their data is being used by North Yorkshire Council.

North Yorkshire Council also utilises information already made public in other online directories so that members of the public can access all relevant information in one location.

The Council has appointed Veritau Ltd to be its Data Protection Officer. Their contact details are:

 

What personal information do we collect and why do we need it?

 

The following personal information is collected when creating an account and is not published online.

• Name: we collect this information to verify your unique identity. We store this with your customer record, so that you can change it at any time yourself.

• Email address: we collect this information to verify your unique identity. We collect this so that we can contact you about the listings you have added if need be, so that we can verify your account, communicate with you about your account and/or any listings that you create and to help you reset your password if need be. We will also use this information to contact you when it is time to review your listing(s). We store this with your customer record, so that you can change it at any time yourself. 

All the above personal information is required for the purposes of creating a Buy Local account. 

 

The following information is collected as part of the published Buy Local directory.

Details such as:

• business name;
• business contact details;
• business services/products offered; and
• opening hours etc.

is made public as part of the listing creation process.

 

Who do we share this information with?

We do not routinely share your account information with anyone outside of North Yorkshire Council. Your personal data provided as part of your account creation will not be published on the Buy Local directory.

Business information, as outlined above, will be made publicly available as part of our Buy Local directory. This business information may also be used by and shared with other district councils and the Local Enterprise Partnership.

 

How long do we keep your information for?

Your information will be retained for the lifetime of your Buy Local account, in line with the retention policy. If an account has no listings associated with it or you choose not to review your listings at the appropriate time, then it will expire after 12 months. When an account expires or consent is withdrawn, all personal information will be deleted and associated business listings will be removed from Buy Local. 

Directory Information will be updated depending on the source of the data and the original lawful basis used.

1. Where legitimate interest has been used, information will be updated and refreshed on a three monthly basis;
2. Where inclusion in the directory is based on your consent, the information will be kept live as long as consent remains in place and your information is routinely reviewed in line with Buy Local Terms & Conditions. 

 

What is our lawful basis for processing your information?

Your personal data is processed by North Yorkshire Council under the lawful basis of consent in regards to the creation of your account. You are free to withdraw your consent at any time, in which case your personal information and Buy Local listing(s) will be deleted. 

Buy Local directory information may also be processed under legitimate interest, as it is in the interest of the public to maintain as complete and easy to access directory as possible and to ensure the contents of that directory are accurate and up to date.  

 

Further information

For more information about how the Council uses your data, including your privacy rights and the complaints process, please see our Corporate Privacy Notice.