This policy (together with our terms of use and any other documents referred to on it) sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by us.

Please read the following carefully to understand our views and practices regarding your personal data and how we will treat it. We will retain information collected about you for as long as permitted for legitimate business purposes.

Our Cookie Policy can be found here.

1. About this document

1.1  At Gascoyne Estates, we are committed to protecting and respecting individuals’ privacy. This privacy notice explains what information we collect about you, how and why we process (collect, store, use and share) your personal information, your rights in relation to your personal information and how to contact us or make a complaint.

1.2  When we process your personal information, we are responsible as ‘controller’ of that information and recognise the need to treat it in an appropriate and lawful manner, in accordance with UK data protection laws.

1.3  Your personal information is information relating to you as an individual. It does not include information relating to organisations.

2. Who are we?

For the purposes of data protection legislation the data controller is:

Gascoyne Estates Limited,
Hatfield Park Estate Office,
Hatfield Park,
Hatfield,
Hertfordshire,
AL9 5NF

ICO registration: Z9750760

3. How Do We Collect And Use Your Information?

(The Personal Information we collect and the use we make of it varies depending on our relationship with you. Please click on the appropriate link to expand, and obtain further details of how we process your personal information)

– Visitors To Our Website

What information do we collect?

We collect information about your visits to our sites including, but not limited to, traffic data, location data, logs and other communication data, and the resources that you access. We may also collect information about your computer, including (where available) your IP address, operating system and browser type. This information is gathered through the use of a third party service: Google Analytics.

How we use your personal information

We collect the information to understand who and how people are visiting our website, so that we can improve user experience of our websites. We do not use your personal information to target you with a personalised experience of our website.

Reasons we can collect and use your personal information

We rely on the following lawful basis in order to collect and use your personal information:

We collect your personal information under our legitimate interests of making improvements to our website.

Who we share your personal information with

We will share personal information with law enforcement or other authorities if required by applicable law.

How long your personal information will be kept

Your personal information is automatically deleted from Google Analytics’ servers after a period of 38 months.

– Job Applicants

What information do we collect?

When you apply for a job with Gascoyne Estates, we ask you to provide personal information as part of your application. This is usually in the form of a CV and cover letter, and may include your name, contact details, education, previous employment and referees, as well as other relevant information that you choose to tell us. We may add personal information (in the form of our evaluation of your ability to undertake the role advertised) during the shortlisting and interview process. Information may be collected by us from 3rd parties, including recruiting specialists, and your former employer or other people that you know for reference purposes.

How we use your personal information

Any personal information that we collect through the recruitment process will be used to assess your suitability for job roles and to contact you in relation to those roles. If you are successful, we need to process your information prior to entering into a contract with you. We may also need to process information from job applicants to respond to legal claims about the recruitment process.

Reasons we can collect and use your personal information

We rely on the following lawful bases in order to collect and use your personal information:

We will only process your personal information where the process is necessary for our legitimate interests of assessing your suitability for employment and communicating with you in relation to that employment. If you are successful in your application, we will also process your personal information in order to enter into a contract of employment with you or to comply with legal obligations relating to your employment We will provide you with our Privacy Notice for Staff at this point.

Who we share your personal information with

All business records, including recruitment records, are stored in the Cloud, hosted by an external IT Support Company, with servers in the UK and the Republic of Ireland. We will not share your information with any other 3rd parties unless your application is successful and it is in our legitimate interests to share it with your referees for the purposes of gaining references prior to employment. We may need to share your personal information with our legal advisers in order to respond to legal claims about the recruitment process. We will share personal information with law enforcement or other authorities if required by applicable law.

How long your personal information will be kept

If your application is unsuccessful, we will retain your personal information for 6 months from the date of the completion of the recruitment process, after which it will deleted or destroyed. We retain a backup of our digital files for up to 180 days, for business continuity purposes.

If your application is successful, your personal information will be kept in accordance with our Privacy Notice for Staff.

– People Who Sign Up To Our Hatfield House Newsletter

What information do we collect?

When you sign up to our mailing lists, we collect your name and email address. There are two channels through which you may sign up to our newsletter: by visiting the subscription page on our website, or by positively opting in when you buy tickets to the house or park on-line.

How we use your personal information

Any personal information that we acquire when you sign up to one of our email lists will only be used to send you the newsletter or emails that you have agreed to receive.

Our newsletter gives details of news and events from Hatfield House and the Estate and is generally issued once a month. The newsletter is part of our marketing strategy.

Reasons we can collect and use your personal information

We rely on the following lawful basis in order to collect and use your personal information:

We will only send you our email newsletters where you have provided your consent for us to contact you this way. You have the right to remove your consent and there will always be a clear unsubscribe link at the bottom of each newsletter.

Who we share your personal information with

When you sign up to our newsletter through the Hatfield House website, you sign up through Mailchimp, which is a marketing automation platform. Your email address is uploaded by our marketing team to Coniq, through which we send our newsletter emails. When you tick the box to opt-in to our newsletter when buying tickets to the house or park, your information is sent to us via a data feed from Merac, our ticketing partners and uploaded to Coniq.

We will share personal information with law enforcement or other authorities if required by applicable law.

How long your personal information will be kept

We will retain your personal information for as long as you would like to continue receiving our newsletter. We will always include an unsubscribe option on our emails. Your details will be deleted from our systems as soon as your unsubscribe email is received.

– People Who Make Group Bookings For Hatfield House

What information do we collect?

When you make a group booking, we collect the name, email address and contact telephone number for the lead member of the party. If you pay by credit card, we also take your card details and address.

How we use your personal information

We ask you for your personal information so that we can process your group booking.

Reasons we can collect and use your personal information

We rely on the following lawful basis in order to collect and use your personal information:

We collect your personal information for the purpose of entering into and performing a contract with you to purchase a group ticket for the house and grounds and so that we can contact you to make arrangements for your group visit.

We will ask you if you would like to receive marketing emails from us in the future when you make your group booking. If you agree then we will use your personal information with your consent. You may withdraw this consent at any time and there will be a clear link to unsubscribe at the bottom of our emails.

Who we share your personal information with

We enter your information into our on-line booking system, myonlinebooking.co.uk, which is hosted by Merac, who provide our on-site and on-line ticketing system. Your credit card details are shared with Sage Pay, who process your payment. We do not store card details on our own servers. All business records are stored in the Cloud, hosted by an external IT Support Company, with servers in the UK and the Republic of Ireland. We will share personal information generally with law enforcement or other authorities if required by applicable law.

How long your personal information will be kept

The personal information that you give us in relation to your booking will be deleted at the end of the year in which you provided us with the information, in line with our retention schedule. We retain a backup of our digital files for up to 180 days, for business continuity purposes.

If you have agreed to continue to receive marketing emails from us, we will retain your personal information for as long as you would like to continue receiving them. We will always include an unsubscribe option on our emails. Your details will be deleted from our systems as soon as your unsubscribe email is received.

– People Who Purchase Tickets For Hatfield House On-line

What information do we collect?

When you purchase tickets on-line, we collect your name, address, telephone number and email address. Your card details are collected via a third party website, Sage Pay, and we do not have access to them.

How we use your personal information

We use your personal information so that we can process your ticket purchase.

Reasons we can collect and use your personal information

We rely on the following lawful basis in order to collect and use your personal information:

We collect your personal information for the purpose of entering into and performing a contract with you to purchase tickets for the house and grounds.

Who we share your personal information with

Our ticket purchases take place on a 3rd party website: myonlinebooking.co.uk, which is hosted by Merac, who provide our on-site and on-line ticketing system. Your credit card details are shared with Sage Pay, who process your payment. We do not store card details on our own servers. We will share personal information with law enforcement or other authorities if required by applicable law.

How long your personal information will be kept

The personal information that you give us in relation to your booking will be deleted at the end of the year in which you provided us with the information in line with our retention schedule. We retain a backup of our digital files for up to 180 days, for business continuity purposes.

– Friends Of Hatfield Park

What information do we collect?

When you apply to become a Friend of Hatfield Park member, we collect your name, address, email address, telephone number, photograph and details of next of kin.

How we use your personal information

We collect your information in order to maintain details of those local residents who are allowed access to Hatfield Park. We will use your contact details in order to contact you about any events or situations that may affect you as a passholder (for example, closure of the Park).

Reasons we can collect and use your personal information

We rely on the following lawful bases in order to collect and use your personal information:

We use your information to keep a record of who has been given a pass to Hatfield Park in order to perform our contract with you.

We use your information to communicate with you in order to perform our contract with you, to meet our legal obligations and pursuant to our legitimate interests in ensuring that you are aware of matters that may affect you as a passholder.

Who we share your personal information with

Your information will be shared internally in order to administer the Friends of Hatfield Park scheme and to send you newsletters. All business records, are stored in the Cloud, hosted by an external IT Support Company, with servers in the UK and the Republic of Ireland. We will share personal information generally with law enforcement or other authorities if required by applicable law.

How long your personal information will be kept

We will retain your information for as long as you remain a member. It will be destroyed at the end of the month in which your pass expires or becomes invalid. We retain a backup of our digital files for up to 180 days, for business continuity purposes. We retain identifying details of anyone who has been banned from the park. This includes your name, address and date of birth. These are retained permanently for the purposes of enforcing the ban.

– Prospective Tenants

What information do we collect?

When you submit your information through our Property Enquiry Form on the Hatfield Park, Cranborne Estate or Gascoyne Holdings Limited websites, we collect your name, current address, telephone number, email address, occupation, family details, details of your requirements (including your budget), and any other information that you voluntary provide. This may include special category data, if for example, you inform us of a disability that may affect your choice of property.

How we use your personal information

Any personal data that you submit through our Property Enquiry Form will be used for the purpose of matching your requirements with our vacant properties.

Reasons we can collect and use your personal information

We rely on the following lawful basis in order to collect and use your personal information:

We use your personal information to send you details of potential properties only where you have provided your consent for us to contact you in this way.

How we will use your sensitive information

This includes information that reveals your racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, genetic information, biometric information used for identification purposes, or information relating to your health, sex life or sexual orientation. It also includes information about your criminal record, offences and related security measures. We will use sensitive information about you in the following ways:

We will only use your sensitive data if you have specifically asked us to use it when matching your requirements to our vacant properties.

Who we share your personal information with

All business records, including property enquiries, are stored in the Cloud, hosted by an external IT Support Company, with servers in the UK and the Republic of Ireland. We will not share your information with any other 3rd parties unless your application is successful, in which case it will be processed in accordance with our Privacy Notice for Tenants. We will share personal information generally with law enforcement or other authorities if required by applicable law.

How long your personal information will be kept

We will retain property enquiries for up to one year, in accordance with our retention schedule. We retain a backup of our digital files for up to 180 days, for business continuity purposes. If your application is successful, your information will be processed in accordance with our Privacy Notice for Tenants.

– Visitors To The Hatfield Estate (Cctv Footage)

What information do we collect?

There are CCTV cameras in various locations around the Hatfield Estate. We collect video footage of individuals who are in the vicinity of the cameras.

How we use your personal information

We are using CCTV to capture video footage in order to monitor the above areas for intruders or antisocial behaviour and for the prevention and detection of crime.

Reasons we can collect and use your personal information

We rely on the following lawful basis in order to collect and use your personal information:
We capture, record and retain video footage in pursuit of our legitimate interests of maintaining the security of Hatfield House and its residents, and to maintain public order.

Who we share your personal information with

Live video footage is viewed by the security team at Hatfield House. Recorded footage can be viewed by members of the team for the above purposes. Live or recorded footage may be viewed by the suppliers of our CCTV maintenance contract, only when required for the purposes of purposes of maintenance and diagnosing faults. Footage may be shared with the Police for the purpose of assisting them with criminal investigations. law enforcement or other authorities if required by applicable law.

How long your personal information will be kept

Video footage is retained for 30 days, after which it is automatically over-written. If footage is required for investigating a crime or incident, it will be kept until it is no longer required for that purpose.

4. Consequences Of Our Use Of Your Personal Information

Our processing of your personal information allows us to decide whether or not to enter into a contract with you, to perform that contract and manage it in the interest of our business and to manage our internal operations. We cannot do any of these things without that information.

5. Transfer Of Your Information Outside Of The EEA

We use external financial administrators, who are based in Jersey. The administrators have access to our live accounting system and other financial records to be able to ensure that adequate control is being exercised over their assets by the Finance Team at Hatfield. As part of this access to accounting records, they can view some personal data. Jersey has been deemed by the European Commission to provide an adequate level of protection for personal data, in line with those provided under European data protection law.

We do not intend to make any further transfers of your information to anyone else outside the EEA during the course of our general operations. The information we hold is stored in the UK and Republic of Ireland. In the event that we do need to transfer your information overseas, we will inform you accordingly.

6. Your Rights

6.1 Under data protection laws you have a number of important rights, which you can exercise free of charge. In summary, these include the right to:

     6.1.1 be informed about the collection and use of your personal information;
     6.1.2 access your personal information and certain other supplementary information that this privacy notice is already designed to address;
     6.1.3 have inaccurate information held about you emended or completed if it is incomplete;
     6.1.4 have personal information erased in certain circumstances.
     6.1.5 request the restriction of your personal data in certain circumstances.
     6.1.6 receive your personal information which you have provided to us, in a structured, commonly used and machine-readable format and require us to transmit that information to a  third party in certain situations.
     6.1.7 object to processing of your personal information where your interest in stopping the processing overrides ours.

6.2 For further information on each of those rights, including the circumstances in which they apply, see the Guidance from the UK Information Commissioner’s Office (ICO) on individuals’ rights under the General Data Protection Regulation.

6.3 If you would like to exercise any of those rights, please:

      6.3.1 email, call or write to us (please see ‘how to contact us’ below),
      6.3.2 let us have enough information to identify you,
      6.3.3 let us have proof of your identity and address (a copy of your driving licence or passport and a recent utility or credit card bill), and
      6.3.4 let us know the information to which your request relates.

7. How To Complain

7.1 We hope that we can resolve any query or concern you raise about our use of your information. If you think that our collection or processing of your personal information has been unfair, then please bring this to our attention by contacting us (please see ‘how to contact us’ below).
7.2 You also have the right to complain to the UK Information Commissioner, who may be contacted at https://ico.org.uk/concerns/ or by telephone on 0303 123 1113. If you live or work elsewhere in the EU or EEA, you can also complain to your local supervisory authority.

8. Changes To This Privacy Notice

We may change this privacy notice from time to time and will notify you of significant changes.

9. How To Contact Us

9.1 Please contact us if you have any questions about this privacy notice, the information we hold about you or if you would like exercise any of your rights under data protection law.
9.2 If you wish to contact us please send an email dataprotection@gascoyne.org or write to Records Manager, Gascoyne Holdings Limited, Hatfield Park Estate Office, The Melon Ground, Hatfield, Herts, AL9 5NB