Privacy Notice
| Reviewed | Approved | Adopted |
|---|---|---|
| 16/09/2026 | 16/09/2026 — Minute ref: 106/2627 | 16/09/2026 |
Valley Community Council uses personal information only where it has a lawful reason and only for purposes connected with its public functions, services, employment, contracts and legal duties. We collect only what we need, keep it secure, retain it for no longer than necessary, and respect your information rights. Further details are provided in this Privacy Notice.
1. About this notice
This notice explains how Valley Community Council (the Council) handles personal information. It applies to residents, correspondents, service users, councillors, employees, job applicants, contractors, suppliers, grant or donation applicants, facility hirers, cemetery applicants and other people who deal with the Council.
Personal information means information relating to an identified or identifiable living person. Information about a deceased person is not personal information under the UK GDPR, although information about living relatives, applicants and representatives remains protected.
The Council processes personal information under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Data (Use and Access) Act 2025, as amended and brought into force from time to time.
2. Who we are and how to contact us
Valley Community Council is the data controller. This means the Council decides why and how personal information is used.
Data-protection contact: Ms Anwen Jones, Clerk and Responsible Financial Officer
Valley Community Council, 10 Gorffwysfa, Lon Fain, Dwyran, Llanfairpwll, Ynys Môn LL61 6YJ
Telephone: 07375 781090
Email: clerk@valley-community-council.wales
Please use these contact details to ask a question, exercise an information right or make a data-protection complaint. If the Council appoints a named Data Protection Officer or external data-protection adviser, the current contact details will be published on the Council's website.
3. Personal information we may collect
3.1 Identity and contact information, including names, addresses, telephone numbers, email addresses, signatures and preferred language or communication format.
3.2 Correspondence, enquiries, complaints, consultation responses, petitions, service requests and records of how matters were handled.
3.3 Council and democratic-governance information, including councillor details, declarations of interest, attendance, allowances, training, committee membership and information required for public registers.
3.4 Financial and transaction information, including invoices, bank details, payments, grants, donations, contracts, quotations and insurance information. The Council does not retain full payment-card details unless a secure authorised payment service requires this.
3.5 Cemetery and memorial information, including applicant and funeral-director contact details, burial arrangements, exclusive rights of burial, grave and memorial records, payments and supporting documents.
3.6 Facility, park, event and letting information, including bookings, keyholders, insurance, risk assessments, incident reports and emergency contacts.
3.7 Employment and recruitment information, including work history, qualifications, references, payroll, tax, pension, attendance, performance, training and workplace adjustments.
3.8 Photographs, video or audio where the Council has a lawful reason to create or publish them. If a meeting or event is recorded, people will be informed where reasonably practicable.
3.9 Technical information generated through the Council's website, email or IT systems, such as IP address, device/browser information, security logs and cookie choices.
4. Where we obtain information
We usually obtain personal information directly from you. We may also receive it from:
4.1 the Isle of Anglesey County Council and other public authorities;
4.2 councillors, employees, contractors, community organisations and professional advisers;
4.3 funeral directors, memorial masons, insurers, banks, payroll or pension providers;
4.4 law-enforcement bodies, regulators, auditors or ombudsman services;
4.5 public registers, published sources, social-media platforms or other people acting with your authority; and
4.6 website, email and security systems when you use those services.
If information comes from another source, we will provide privacy information where the law requires and where doing so is possible and proportionate.
5. Why we use information and our lawful bases
We must have a lawful basis each time we use personal information. The basis depends on the purpose and circumstances. The main purposes are set out below.
| Purpose | How we use the information | Main lawful basis |
|---|---|---|
| Council administration and public enquiries | To respond to residents, manage correspondence, consultations, petitions, service requests and complaints, and carry out Council decisions. | Public task; legal obligation. |
| Meetings and democratic governance | To prepare agendas and minutes, administer meetings, co-option, councillor duties, declarations, allowances, training and required public registers. | Public task; legal obligation. |
| Finance, audit and public money | To set budgets and precepts, maintain accounts, process payments, grants and donations, prevent fraud and support internal and external audit. | Legal obligation; public task; contract where applicable. |
| Cemetery and memorial services | To administer burials, exclusive rights, memorial applications, grave records, fees, safety and liaison with funeral directors and families. | Public task; legal obligation; contract. |
| Parks, facilities, lettings and events | To manage bookings, licences, keys, insurance, safety, incidents, community facilities and Council events. | Public task; contract; legal obligation; consent for genuinely optional publicity where appropriate. |
| Employment and recruitment | To recruit and employ staff, pay salary and pension, manage attendance, performance, training, health and safety, and meet employment duties. | Contract; steps before a contract; legal obligation; public task where applicable. |
| Safety, safeguarding and insurance | To assess and control risks, record incidents, protect people and property, manage claims and cooperate with emergency or safeguarding bodies. | Legal obligation; public task; vital interests in emergencies; recognised or standard legitimate interests where lawful and outside official tasks. |
| Website, communications and information security | To publish Council information, provide essential service updates, operate email and website services, maintain records and protect networks and accounts. | Public task; legal obligation; consent for optional subscriptions; legitimate interests for non-official security or administrative uses where lawful. |
| Legal claims, investigations and regulatory cooperation | To establish, exercise or defend legal rights, respond to auditors and regulators, and prevent or detect crime, fraud or misuse of public funds. | Legal obligation; public task; recognised legitimate interests or legitimate interests where available. |
Public task means that processing is necessary for the Council to exercise official authority or perform a task in the public interest that is laid down by law. The Council will not rely on standard legitimate interests to carry out its official public tasks.
Where consent is the lawful basis, you may withdraw it at any time. Withdrawal does not affect processing that was lawful before consent was withdrawn. Refusing or withdrawing consent will not affect statutory services that rely on another lawful basis.
6. Special-category and criminal-offence information
Some information requires extra protection, including information about health, disability, racial or ethnic origin, religious or philosophical beliefs, political opinions, trade-union membership, sex life or sexual orientation, genetic data and biometric data used for identification.
The Council will use special-category information only when an Article 6 lawful basis and an Article 9 condition apply. Depending on the circumstances, this may include employment and social-protection obligations, substantial public interest, legal claims, vital interests or explicit consent. Appropriate safeguards and access controls will be used, and the Council's Appropriate Policy Document will apply whenever Schedule 1 of the Data Protection Act 2018 requires it.
Criminal-offence information will be processed only where authorised by law and subject to appropriate safeguards, for example where a lawful safeguarding check, investigation or fraud-prevention measure is necessary.
7. Public records, meetings and transparency
As a public body, the Council must publish or make available certain information. This can include agendas, minutes, decisions, councillor details, declarations of interest, payments, audit information, contracts and other records required by law or the Council's publication scheme.
Information given during a public meeting or in correspondence may appear in a public record where this is necessary, proportionate and lawful. The Council will avoid publishing unnecessary personal information and will redact or withhold information where an exemption or confidentiality requirement applies.
Requests under the Freedom of Information Act 2000 or Environmental Information Regulations 2004 are handled separately from requests for personal information. The Council will balance transparency duties with data-protection rights.
8. Who we may share information with
We share personal information only when necessary, proportionate and lawful. Recipients may include:
8.1 the Isle of Anglesey County Council, Welsh Government and other public authorities;
8.2 Audit Wales, internal auditors, HM Revenue and Customs, payroll and pension providers;
8.3 the Public Services Ombudsman for Wales, the Information Commissioner's Office, police, courts, tribunals and regulators;
8.4 banks, insurers, solicitors, professional advisers and debt-recovery services where lawful;
8.5 funeral directors, memorial masons, cemetery contractors and relevant service providers;
8.6 contractors and suppliers providing website, email, cloud storage, IT support, translation, printing, maintenance, security or other services;
8.7 community organisations or project partners where a joint activity requires information sharing; and
8.8 members of the public where publication or disclosure is required by law or justified in the public interest.
Where another organisation acts as a processor on our behalf, we require an appropriate written contract and data-protection safeguards. Where organisations decide their own purposes, they act as separate controllers and are responsible for their own compliance.
We will not sell personal information.
9. International transfers
The Council aims to keep personal information within the United Kingdom. Some approved technology or cloud-service providers may store or access information in another country. Where this occurs, the Council will use a transfer permitted by UK data-protection law, such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved contractual clauses, or another lawful safeguard. Further information about a relevant safeguard is available on request, subject to lawful confidentiality restrictions.
10. How long we keep information
We keep information only for as long as it is needed for the purpose, to meet legal or audit duties, to preserve records of public value, or to establish or defend legal claims. The Council's approved retention schedule takes precedence. The following periods are the normal starting point and may be extended where law, audit, safeguarding, insurance, litigation, an active complaint or a preservation requirement applies.
| Record type | Normal retention | Notes |
|---|---|---|
| Signed minutes, decision records and records selected for public archive | Permanent | Public accountability and historical record. |
| Cemetery, burial and exclusive-right records | Permanent | Long-term statutory and operational record; living-person contact data is minimised when no longer required. |
| Accounts, audit, VAT, payroll and supporting financial records | Normally 6 years after the relevant financial year | Longer if required by HMRC, Audit Wales, pension rules or an active investigation. |
| Contracts and procurement records | 6 years after the contract ends; 12 years if executed as a deed | Longer where a claim, warranty or statutory requirement continues. |
| Grant applications and donations | Unsuccessful application: 2 years after the decision. Successful grant or donation: 6 years after the award or arrangement ends. | Aligned with the Records Retention and Disposal Policy. Core details may remain in minutes or accounts permanently. |
| Facility and event bookings, lettings | 3 years after the event or booking | Aligned with the Records Retention and Disposal Policy. Incident, safeguarding or contractual records may require longer. |
| Formal complaints and investigations | 6 years after closure | Longer for recurring issues, legal claims, safeguarding or regulator requirements. |
| Routine enquiries, service requests and correspondence | Normally 2 years after closure | Delete earlier if no continuing purpose; retain longer if the matter becomes formal or legally significant. |
| FOI, EIR, subject-access and information-rights case files | Normally 3 years after closure | Longer if reviewed, appealed, complained about or required as evidence. |
| Councillor declarations and governance records | Current term plus 6 years | Published decision records and minutes may be permanent. |
| Employee personnel records | Normally 6 years after employment ends | Some payroll, pension, health and safety or safeguarding records may require longer retention. |
| Unsuccessful recruitment applications | Normally 6 months after the process ends | Longer only with consent or where needed for a legal claim. |
| Accident, incident, safeguarding and insurance records | According to the applicable legal and insurer limitation period | This may be longer where a child or vulnerable person is involved. |
| Photographs, optional mailing lists and consent records | Until no longer needed or consent is withdrawn; review at least every 3 years | A minimal suppression record may be retained to respect an opt-out. |
| Website and security logs | Normally up to 12 months | Longer where needed to investigate a security incident or legal claim. |
11. How we protect information
The Council uses proportionate technical and organisational measures, including role-based access, secure devices and accounts, multi-factor authentication where available, password controls, backups, secure disposal, staff and member awareness, supplier checks, incident reporting and confidentiality requirements. Access is limited to people who need the information for an authorised purpose.
No method of storage or transmission is completely risk-free. If a personal-data breach occurs, the Council will assess the risk, take containment and recovery action, keep a breach record, and notify the ICO and affected individuals where the law requires.
12. Your information rights
Depending on the circumstances and lawful basis, you may have the right to:
12.1 ask for confirmation that we use your personal information and receive a copy;
12.2 ask us to correct inaccurate or incomplete information;
12.3 ask us to erase information in certain circumstances;
12.4 ask us to restrict how information is used in certain circumstances;
12.5 object to processing based on public task or legitimate interests, including an absolute right to object to direct marketing;
12.6 receive information you provided in a portable format where processing is automated and based on consent or contract;
12.7 withdraw consent at any time where consent is the basis; and
12.8 challenge a significant decision made solely by automated processing and request appropriate safeguards where applicable.
These rights are not absolute. For example, the Council may need to retain minutes, financial records, cemetery records or other information to meet a legal duty or perform a public task.
To make a request, contact the Clerk using the details in section 2. We may ask for information needed to confirm your identity or clarify the request. We normally respond within one month starting when we have the request and any information reasonably required to verify identity or applicable fee. The period may be extended where the law permits, and we will explain any extension.
13. Data-protection complaints
If you are unhappy with how the Council has used your personal information or handled an information-rights request, please contact the Clerk first. You may complain by email, post or telephone using the details in section 2.
The Council will provide reasonable help to make a complaint, acknowledge it as soon as practicable and no later than 30 days, investigate it appropriately, and communicate the outcome without undue delay. We aim to acknowledge complaints within five working days where possible. We will tell you about any action taken and your right to complain to the Information Commissioner's Office.
Information Commissioner's Office: Make a data-protection complaint | Telephone 0303 123 1113
You can contact the ICO without first complaining to the Council, although the ICO will usually expect you to give the Council an opportunity to respond.
14. Children and people needing support
The Council may occasionally process information about children or adults at risk in connection with events, facilities, complaints, safety or safeguarding. We collect the minimum necessary information, use age-appropriate and accessible explanations where required, and involve a parent, guardian or representative where appropriate and lawful. Emergency or safeguarding information may be shared without consent where another lawful basis applies.
15. Automated decisions
The Council does not currently make decisions that have legal or similarly significant effects using solely automated processing. If this changes, we will explain the logic, likely consequences and safeguards, and provide the rights required by law.
16. Website, cookies and social media
The Council's website and service providers may process technical information necessary to deliver and secure the website. Cookies and similar technologies will be used in accordance with applicable data protection and electronic communications legislation. Where consent is required for non-essential cookies, users will be given a choice.
Some website features, including embedded maps, may be provided by third-party mapping services. When these features are viewed, the service provider may receive technical information, such as your IP address, as part of providing the map content.
Social media platforms are separate controllers of personal data processed through their services. Information posted publicly on these platforms may be visible to others. Please avoid posting sensitive personal information in public comments and contact the Clerk privately where appropriate.
17. Changes and alternative formats
We keep this notice under review and will publish the current version on the Council's website. Material changes will be highlighted where appropriate. Earlier versions will be retained as governance records.
This notice should be published in English and Welsh. Accessible or alternative formats can be requested from the Clerk.
