This privacy notice explains how we use and share information. We will review and update this privacy notice to reflect changes in our services and feedback from service users, as well as to comply with changes in the law.
Who we are and what we do
The Culture Team at Durham County Council is leading the Place Labs initiative, which delivers arts-based community programmes across County Durham. This includes a network of physical Place Lab locations, alongside a web-based platform designed to coordinate activity, showcase creative work, and promote the wider initiative.
The platform also features a dedicated digital space for users who are interested in digital art or who may be unable to access the physical locations. It allows users to connect with others who share similar interests, collaborate creatively, and engage with the initiative online.
For the purposes of Data Protection, Durham County Council is the Data Controller.
The types of personal information we collect and how we collect it
When you sign up to the website, we collect the following personal information:
- Your name
- Your email address
- Your username
We collect information about you through an online form on The Place Labs website.
How we use your personal information
The Place Labs collects and uses information about you:
- To sign up and register you on our website
- To send system notifications
- To sign up and register you on our website
- To send system notifications
- To verify your email address
- To ensure the security of your account and protect it against unauthorised access
- To facilitate user interactions and collaborations within the Place Labs website
- To allow us to moderate content on the Place Labs and ensure compliance with community guidelines
- To respond to user queries, feedback, or support requests
Some of our services use Artificial Intelligence (AI) tools to support us in our service delivery.
What our lawful basis is to obtain and use your personal information
The following is the lawful basis Article 6 of the UK General Data Protection Regulation (UK GDPR) for processing your personal information:
- 6(a) – The data subject has given consent to the processing of their personal data for one or more specific purposes.
Reasons we may share your personal information
Microsoft Office 365 is the platform used for many of the council’s desktop and collaboration services. This cloud-based suite updates our previous versions of Microsoft Office and introduces new tools for a more collaborative working environment. View Microsoft’s privacy information.
Processing personal information outside of the UK/EU
Your personal data is stored on our IT infrastructure and shared with our data processors, Microsoft and Amazon Web Services. It may be transferred and stored securely in the UK and European Economic Area (EEA). If your data is stored outside the UK and EEA, it will have equivalent legal protection through Model Contract Clauses.
We can share information outside of this area when there is an adequacy determination in place. The EU uses the term ‘adequacy’ to describe other countries, territories, sectors or international organisations that it deems to provide an ‘essentially equivalent’ level of data protection for people’s rights and freedoms.
How your information is kept secure
The security of your personal information is important to us. This is why we follow a range of security policies and procedures to control and safeguard access to and use of your personal information.
We have multiple policies in place that define our commitments and responsibilities to your privacy and cover a range of information and technology security areas.
We also provide training to staff who handle personal information and treat it as a disciplinary matter if they misuse or do not look after your personal information properly.
How long we keep your information for
We will not keep your information longer than it is needed or the law says we can. We will dispose of paper records or delete any electronic personal information in a secure way.
Our Records management page provides more details of records management and information within the council.
The Place Labs data will be retained while the user is active on the platform or for a period of 12 months of inactivity. After this period, the account and associated data will be deleted from the database. Users can delete their own account and associated data using the user dashboard at any time.
Marketing
At no time will your information be used or passed to others for marketing or sales purposes, or for any commercial use without your express consent.
Your Information Rights
Your Information Rights are set out in the law. Subject to some legal exceptions, you have the right:
- Your right of access – you have the right to ask us for copies of your personal information. This is also known as a Subject Access Request (SAR). You can make a SAR by completing the online form on our Find out what information we hold about you page.
- Your right to rectification – you have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
- Your right to erasure – you have the right to ask us to erase your personal information in certain circumstances.
- Your right to restrict processing – you have the right to ask us to restrict the processing of your personal information in certain circumstances.
- Your right to object to processing – you have the right to object to the processing of your personal information in certain circumstances.
How your rights work depends on the legal basis for collecting and using your personal information. The following rights are modified depending on the legal basis:
| Legal basis | Right to erasure | Right to portability | Right to object |
| Consent | Yes | Yes | No (but right to withdraw consent) |
| Contract | Yes | Yes | No |
| Legal obligation | No | No | No |
| Vital interests | Yes | No | No |
| Public task | No | No | Yes |
| Legitimate interests | Yes | No | Yes |
Further Information
If you wish to exercise your information rights, please contact the Data Protection Officer at DPO@durham.gov.uk or inforights@durham.gov.uk or alternatively write to:
DPO
Chief Executive’s Service
Durham County Council
PO BOX 274
Stanley
County Durham
DH8 1HG
If we have not been able to deal with your complaint, you can also contact:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Telephone: 0303 123 1113 (local rate) or 01625 545 745
You also have the right to request a copy of the personal information the council holds about you. To do this, you can apply online or download an application form from our Data Protection & Freedom of Information page, or you can contact the data protection team at inforights@durham.gov.uk
To learn more about these rights please see Information Commissioner’s Office: Individual rights – guidance and resources. If you require general information about the Data Protection Act, information is available at Information Commissioner’s Office: Individual rights – guidance and resources. Additionally, any complaints can be escalated beyond the ICO as outlined in GDPR Article 77 and GDPR Article 79.
More information about The Place Labs website
Data visible to other users on the platform
When you create your account, other users can see your name, profile picture (recommended but optional), the date you’ve joined, and any public comments or submissions you’ve made – nothing more – the same way you can see what submissions or comments they’ve left as well.
Data visible to platform admins
Platform admins are the people that manage and run the platform, and therefore also have access to other data provided by you on the platform, for instance in the registration process.
We ask you to verify your email before you can take part
We collect your email address as part of the registration process, email addresses are verified through an email confirmation process, to confirm that they exist and belong to real users.
We do not share this information publicly. Only platform admins have access to the data provided during verification.
Reviewing and updating your profile
You can review and update your data anytime through your profile settings. All your personal data is subject to the privacy policy, outlined above, and which you agree to when you first register your account. You can find this at any time by going to the bottom of the page and selecting “Privacy Policy”.