Privacy Notice (draft)
Brill Parish Council Privacy Notice (v2)
Purpose and scope
This Privacy Notice is addressed to residents and all other users of amenities and services (“you”) provided by Brill Parish Council (“we” or “the Parish Council”).
It concerns the processing (collection, storage, use, and disposal) of your personal data by Brill Parish Council and covers the following topics:
What is personal data?
Parish Council responsibilities
The personal data we collect and lawful basis for doing so
Collecting and storing your personal data
Sharing your personal data
Your rights and your personal data
Website privacy
Questions, requests and complaints
1.What is personal data?
Personal data is any information that can identify a living individual, either alone, or with other information. This includes names, date of birth, physical address and email address.
In the UK, data protection is governed by the UK General Data Protection Regulation (GOV.UK website opens in new tab) and the Data Protection Act 2018 (GOV.UK website opens in new tab).
The Data (Use and Access) Act of 2025 (ICO website opens in new tab) may also have implications in the future.
2. Parish Council responsibilities
Brill Parish Council (and all organisations responsible for processing personal data) must make sure personal data is -
used fairly, lawfully and transparently
used for specified, explicit purposes
used in a way that is adequate, relevant and limited to only what is necessary
accurate and, where necessary, kept up to date
kept for no longer than is necessary
handled in a way that ensures appropriate security, including protection against unlawful or unauthorised processing, access, loss, destruction or damage
This Notice explains how the Parish Council meets these responsibilities.
Data Protection Officer
The Data Protection Officer for Brill Parish Council is the Parish Clerk. Contact information for Brill Parish Council.
3. The personal data we collect and lawful basis for doing so
There are six legal bases for the processing of personal data but most parish councils make regular use of just three: Public task, Legal obligation, and Legitimate interest or consent.
Public task
This covers the processing of personal data in order to perform a task carried out by the Parish Council that is in the public interest or the exercise of official authority. In Brill this includes the following:
Publication of minutes and agendas. Minutes often include names of residents and Parish Council contractors.
Publication of financial statements. These statements include names of payees and their business.
Administration of contracts. Contracts include names and addresses of the parties involved.
Management of MUGA bookings. People give their name and contact details when they book the MUGA.
Management of planning applications. We only use addresses in Minutes but the Planning Department website includes names.
Processing of Section 137 Grants. The request form requires names and contact details, plus personal connection to the organisation needing funds.
Recording, researching and responding to questions and concerns from residents received by phone, personal contact, letter, email or contact form on the website. Communications always includes names and contact details - and sometimes property details and mentions of health or age.
Legal obligation
The Parish Council has two employees and is obliged to keep employment-related records, including PAYE. Public-facing legal obligations involving personal data include the following:
Publication of audit records, including names and businesses of payees.
Publication of annual accounts, also including names and businesses of payees.
Sharing of names and contact details in connection with legal proceedings - or, in extreme circumstances, with the Police or statutory bodies, such as Safeguarding or Child Protection agencies.
Legitimate interest or consent
Recent Brill examples of this basis for processing personal data include:
Voluntary subscription to the Parish Council monthly e-newsletter.
Survey to assess interest in Brill Common events and activities.
Survey to gather opinions of MUGA users.
Booking form to enrol students for first aid classes. This form included a yes/no question regarding mobility issues.
Traffic management poll on Facebook. Facebook profiles were noted by the system to avoid duplicate responses but these did not appear in the analysis.
Booking form for Brill Community Market stall-holders. This data is collected by Parish Council website but handled by The Brill Society.
Lists of volunteers contributing to the management of Brill Common.
Directory of Brill groups, clubs and organisations on the website.
4. Collecting and storing your personal data
Data collected through the website
Brill Parish Council’s website is hosted by Squarespace, a large and reputable organisation. Personal data submitted through one of the forms is handled by up-to-date security protocols and stored in Squarespace data centres in the USA. Information is accessed locally through the Squarespace interface by the website designer/editor on their laptop. The Parish Council Squarespace account is protected by password and multi-factor authentication. The laptop used is protected by password and biometrics and is securely stored.
Website forms are designed to gather the minimum information necessary to meet the purpose of each form. Street addresses and dates of birth are very rarely requested. Data collected by Squarespace is manually checked for relevance and accuracy and then forwarded by secure email to the relevant person (for example, to The Brill Society for Community Market business or the Wildlife & Community Ranger for Brill Common matters).
The Clerk, and Parish Council systems
The Parish Clerk receives personal data from a number of sources, including website forms (either received directly or forwarded by the web designer/editor), emails, and phone calls, letter or conversations. Matters not immediately dealt with are digitally logged. Some communications are shared with councillors by email.
Brill Parish Council is in the process of moving to gov.uk emails for all councillors and employees. Emails are managed using secure, password-protected systems, ideally with additional multi-factor authentication. Parish Council documents are stored in a secure online Dropbox. The Clerk is responsible for removing email privileges and Dropbox access from councillors or employees when they leave the Parish Council.
The Clerk and Wildlife & Community Ranger use official laptops but councillors use their own devices. Security of these devices and systems is covered by the Parish Council IT Policy.
Disposal of personal data
The Parish Council follows the guidance provided by the National Association of Local Councils (NALC) for the retention of official documents (NALC website opens in new tab).
The Parish Council’s IT Policy emphasises the importance of sound “digital housekeeping” on official devices, and personal devices used for Parish Council business. This means the regular organising and sorting of emails and computer files, and secure deletion of out-dated or redundant information. Personal data should only be retained if there is a defined, on-going requirement.
The newsletter subscribers list stored within the Squarespace interface is regularly checked, and redundant or duplicate information removed.
Sensitive information
Sensitive information includes information about an individual’s race, ethnic background, political opinions, religious beliefs, health, and sexual orientation. The Parish Council does not collect this information and would only do so in the future in response to a defined need and with the involvement and consent of residents.
5. Sharing your personal data
The Parish Council newsletter is prepared and published by email within the Squarespace interface. This means that subscribers’ names and email addresses are not transferred to another system. The subscriber list will never be sold or shared, even within the community.
Very occasionally, the Parish Council may contract a distribution agency to post or deliver printed information to households across the parish. The Parish Council does not have a list of residents so the Electoral Roll (already in the public domain) would be used.
The Parish Clerk may share personal data with Buckinghamshire Council and other official bodies in the following circumstances:
to ask for help for a resident experiencing hardship or administrative confusion
to report a problem with an amenity or service impacting on individual properties
to submit an opinion on local planning applications
to process disputes, complaints or legal proceedings
to support a funding application
to convey community concern or opinions with specific examples
to comply with a Police request for information or report a Safeguarding concern
This list is not exhaustive. In almost all cases, the Clerk will share information with the implicit or explicit consent of the individuals involved. Once the information is shared, Buckinghamshire Council (or other body) becomes responsible for processing your personal data.
6. Your rights and your personal data
Right to be informed
You have the right to be informed about the collection and use of your personal data by the Parish Council. That is the purpose of this Notice.
Right of access
You have the right to access and receive a copy of your personal data held by the Parish Council. Please contact the Clerk to make your request.
Rights to rectification, restriction or suppression
You have the right to have your personal data corrected or updated as required. If you complete a web form incorrectly or know of other errors, please contact the Clerk.
You also have the right to request the restriction or suppression of your personal data; to ask that it be used only for certain purposes.
Rights to object and erasure
You have the right to object to the processing of your personal data in certain circumstances. You also have the right to have your personal data removed - but be aware that doing so may stop a service being provided. Sometimes if may not be possible to erase your data; for example, if there are on-going legal proceedings.
There is an ‘unsubscribe’ button at the end of every newsletter.
You also have the right to ‘data portability’. This means you can ask for your data to be moved to another Data Controller or to use it yourself for other purposes.
7. Website privacy
Internet cookies
Cookies are small text files generated by the webserver and stored on your web browser. Cookies are an integral part of the internet and all websites use them.
There are two types of cookies; essential and non-essential. The Brill Parish Council website uses only essential cookies. Essential cookies do not track you or collect personal data. No consent is required for their use but we are still obliged by GDPR to tell you they are present.
All website need essential cookies to function correctly and so they cannot be turned off. The essential cookies used by the Parish Council website have two main functions:
Session management. This enables your browser to keep track during your visit - for example, remembering the information you have entered into a form so you don’t have start over should you leave the page.
Security. Essential cookers protect both the website and its users, maintaining a secure connection and preventing digital attacks.
Third party websites
The Parish Council website contains links to other websites. We choose these website carefully and mainly link to well-known and reputable sites like GOV.UK and Bucks Council. We are not responsible for the privacy policies or practices of any third party websites.
8. Questions, requests and complaints
If you have any questions about this Privacy Notice or the personal data we hold about you, or you wish to exercise your rights (including the correction or removal of personal data) or make a complaint, please contact the Parish Clerk.
If, after discussion with the Parish Clerk, you remain concerned about any aspect of the processing of your personal data by Brill Parish Council, contact the Information Commissioner’s Office (website opens in new tab).
This Notice
The original version of this Notice was compiled from a template supplied by the National Association of Local Councils and adopted by Brill Parish Council in November 2021.
The Notice was substantially revised by Hannah Hulme Hunter in February 2026 and the new version was adopted by Brill Parish in March 2026.
For formal review in 2028, given the speed of change in information technology. However, should circumstances change before then, we reserve the right to update this policy and post a new version on our website at any time. You should check this page occasionally to ensure you are happy with any changes.
