Supporting NHS Test and Trace Privacy Notice
This Privacy Notice sets out what you need to know about how English Heritage is supporting NHS Test and Trace. English Heritage is committed to meeting its data protection obligations and handling your information securely.
English Heritage is the Data Controller for information you provide to us and is responsible for compliance with data protection legislation for the period that we hold it.
This policy was last updated on 13 April 2021 following the introduction of legislation which made it mandatory for English Heritage to record contact details of customers, visitors and staff. This means:
- The lawful basis for processing data for NHS Test and Trace has changed from legitimate interests to legal obligation.
- You no longer have the right to opt out of sharing your details for purpose of NHS Test and Trace
What information do we collect?
We will collect contact information of visitors (including school and group organisers), customers, contractors, volunteers, members of the public using takeaway catering facilities and staff including:
- Telephone number
- Date of visit, arrival time and for staff and volunteers where possible, departure time
How do we collect information about you?
Information is collected from the details that you provide to us directly when booking or visiting one of our sites or properties. This includes information provided when booking timed tickets to visit our sites.
For staff and volunteers, we will use the contact information you have provided to us and which we have on file.
How will your information be used?
We will only use information for the purpose for which it has been collected.
Where it is necessary for us to collect information which we would not normally collect in our usual course of business it will only be used for the purposes of NHS Test and Trace. We will not use this information for any other purpose such as marketing.
The legal basis for using your information
Processing your personal data for the purposes of NHS Test and Trace is necessary for English Heritage to comply with its legal obligation as set out in the Health Protection (Coronavirus, Collection of Contact Details etc and Related Requirements) Regulations 2020.
Who will your information be shared with?
NHS Test and Trace will only ask English Heritage for this information where it is necessary, either because someone who has tested positive for COVID-19 has listed one of our properties as a place they visited recently, or because one of our properties has been identified as the location of a potential local outbreak of COVID-19.
We will only share this information when it is requested by NHS Test and Trace. We will ensure that this information is shared in a safe and secure way.
Where information is shared with NHS Test and Trace the Department of Health and Social Care (DHSC) will be data controller for the information at the point it receives the data from English Heritage. The DHSC Privacy notice for maintaining records of staff, customers and visitors to support NHS Test and Trace is available at https://www.gov.uk/government/publications/privacy-notice-for-maintaining-records-of-staff-customers-and-visitors-to-support-nhs-test-and-trace/privacy-notice-for-maintaining-records-of-staff-customers-and-visitors-to-support-nhs-test-and-trace
How long will we keep your information?
We will only use and store your information for as long as it is required for the purposes it was collected for including for the purposes of satisfying any legal, accounting, or reporting requirements. We retain booking information for 7 years.
Information that is collected solely for the purposes of NHS Test and Trace will be retained for 21 days from the date of your visit.
The NHS Test and Trace Scheme helps us to keep our customers, visitors, contractors, staff and volunteers safe. English Heritage is required by law to record and share customer data if it is requested by the NHS, in order to participate in this scheme.
The Data Protection Officer for English Heritage is Lynda Bennett and she can be contacted by sending an email to email@example.com
Changes to this privacy notice
We may change this privacy notice. When we make changes to this notice, the ‘last updated’ date at the top of this page will also change. Any changes to this privacy notice will apply to you and your data immediately. If these changes affect how your personal data is processed, we will take reasonable steps to let you know.