Car parking privacy notice

Why are we collecting your information?

This Privacy Notice has been written to inform you that York and Scarborough Teaching Hospital NHS Foundation Trust (the Trust) processes information about you to administer the operation of the car park payment system.

Who do we collect your information from?

Images of your vehicle entering and exiting the multi storey car park are collected via the ANPR system. CCTV cameras will record images of drivers and passengers of the vehicles entering and exiting the car park. The CCTV cameras will record images of the pay station areas which will include images of customers and those in the vicinity of the pay station.

Who are we?

The Trust is a ‘Data Controller’, this means that we determine the purposes for which, and the way your personal data is processed. We have a responsibility to you and your personal data and will only collect and use this in ways which are compliant with Data Protection legislation.

The Trust has appointed Rebecca Bradley (Head of Information Governance) to be its Data Protection Officer (DPO). The role of the DPO is to ensure that the Trust is compliant with Data Protection legislation and to oversee data protection procedures. The DPO contact details are:

York and Scarborough Teaching Hospital NHS Foundation Trust,
York Hospital,
Wigginton Road,
York,
North Yorkshire,
YO31 8HE
Yhs-tr.Information.Governance@nhs.net

What Information are we collecting?

Vehicle registration number
Image of driver and passenger entering and exiting the car park

What is our lawful basis for processing your information?

Article 6(1)(f) Legitimate interest: The overall purpose of ANPR is for parking management, to help in crime prevention, investigation of crime, to protect Trust staff and visitors, and to protect Trust premises from criminal activities. A full legitimate interests’ assessment is available on request.

How long do we keep your information for?

Recordings are kept for 31 days on an encrypted Network Video Recorder, allowing adequate time for data requests to be processed if relevant. After the 31 days the data is automatically deleted. V2 June 2024

Who do we share your information with?

York and Scarborough Teaching Hospitals NHS Foundation Trust
Local Authorities
Driver and Vehicle Licensing Agency (DVLA)

Do we transfer your information outside the UK?

This is not standard practice and it would only be shared if necessary for legal purposes or if your consent has been given.

What rights do you have over your data?

Under GDPR data subjects have the following rights in relation to the processing of their personal data:

to be informed about how we process your personal data. This notice fulfils this obligation
to request access to your personal data that we hold, and be provided with a copy of it
to request that your personal data is amended if inaccurate or incomplete
to request that your personal data is erased where there is no compelling reason for its continued processing
to request that the processing of your personal data is restricted
to object to your personal data being processed

If you have any concerns about the way we have handled your personal data or would like any further information, then please contact DPO on the address provided above. To put in a Subject Access Request please contact: yhs-tr.cctv@nhs.net.

If you do not want to receive text messages from the Trust there is an opt out option for this.

If we cannot resolve your concerns you may also complain to the Information Commissioner’s Office (the Data Protection Regulator) about the way in which the Trust has handled your personal data. You can do so by contacting:

First Contact Team
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
casework@ico.org.uk // 0303 123 1113

V2 - June 2024