Privacy notice for House of Commons Catering Services

1. About Us

We are the House of Commons, London, SW1A 0AA - which we’ll refer to as “HOC” in this notice. The Corporate Officer (Clerk of the House) is the Controller of any personal information processed as described in this Privacy Notice.

We have a Data Protection Officer, the Head of Information Compliance, who ensures that the day-to-day obligations of the Data Protection Legislation are met. If you have any questions about this Privacy Notice, or if you wish to exercise your rights or contact the Data Protection Officer, you can email hcinformationcompliance@parliament.uk or telephone +44 (0)20 7219 4296. Alternatively, you can write to Information Compliance Service, House of Commons, London, SW1A 0AA marking it for the attention of the Data Protection Officer.

The Information Compliance Service is responsible for HOC’s compliance with Data Protection Legislation by ensuring requests are handled in line with our obligations and information is made publicly available where appropriate.

2. The personal data we collect

We will need to ask you for certain personal information to deliver the services you have asked for and to give you the best possible experience when you engage with us and when you use our products and services.

Most of the personal information we process is provided to us directly by you for one of the following reasons:

• You have made an enquiry to us
• You have made a complaint to us, or would like to provide a comment or feedback
• You wish to attend, or have attended, an event
• You wish to make a table reservation in one of our restaurants
• You subscribe to a newsletter
• You are representing your organisation
• You have nominated someone for an award
• You fill in a form, for example, when ordering catering for an event or meeting room, or if recording an accident or near miss on site

We will process your personal information to:

• Enable you to access and use some of our services
  We will use your information to accept you as a new/returning customer. We will also use it to provide you with our products and services or fulfil a contractual agreement between you and us to provide you with commercial activities and services.
• Let you know about significant changes to our products, terms, or privacy policy
  We will let you know by email if there are significant changes to our products, their features, our terms, or our privacy policy.
• Confirm your identity and authenticate the information you provide
  As part of providing some services to you we will confirm your identity and authenticate the information you provide for security purposes. Establishing your identity is important and we must be sure you are who you say you are. Identity checking may also involve checking the registration information you give us against information we already hold about you and potentially publicly available information about you such as from social media and/or from company websites.
• Process payments and collect arrears
  We will use your information to process the payments you commit to when signing up to events or ordering hospitality in meeting rooms and for the collection of any future payments or overdue amounts for those services.
• Provide and improve the customer experience
  We will use your information to be able to provide and improve the customer experience we provide to you.
• Administration of offers, surveys and other promotional activity
  From time to time we will run promotions and surveys and, we will use the personal data you provide to us, to run such activities and to do what we agree to do as part of them.
• Marketing
  We will use the personal data we hold about you for marketing purposes in 2 ways:
  
  • to send you marketing communications by email or post;
    

    Please note that you can opt-out from us processing your personal data for marketing purposes at any time by clicking here. You can also email us at hoceventsteam@parliament.uk

  • to create marketing content and to refine our marketing strategies.
• Send you service communications
  We will use your information to contact you to tell you about changes to or issues affecting the services you are taking.
• Comply with the law
  Like any other business, we are required to comply with many laws and regulations. Where necessary (i.e. where it is reasonable and proportionate for us to do so), we will use your personal data to the extent required to enable us to comply with these requirements.
• Investigation, detection, and prevention of crime
  We may use your information for the investigation, detection, and prevention of crimes (other than fraud).
• Internal training purposes
  We will use your information to ensure that our teams have the knowledge and expertise they need to ensure we provide the best possible experience to our customers when interacting with us.
• Reporting, analytics, and product development
  We will use your information and how you respond to our emails to understand you, and how you use our services. We can, where applicable, combine this with information provided by third parties or other teams at UK Parliament. This analysis or the data will be used to enable us to continue to provide our services efficiently, in the sending of communications, to improve and promote our products and services, develop new products, to provide educational content, generate consumer insight and to provide appropriate levels of support to our customers.
• Maintain our records and other administrative functions
  Like any other business, we need to ensure that we maintain comprehensive and up to date records of the ways we process your personal information and other operational activities and therefore we will process the information you provide for record-keeping, updates, and general administrative purposes.
• Complaint and dispute resolution
  Whilst we try to make sure that you are happy with the service we provide and do not feel the need to complain, if you do complain to us, we will use the information we have about you to help us manage your complaint.
• Improve data accuracy and completeness
  Personal information you provide to us when you access and use some of our services may be used to improve the information we already hold about you e.g. you provide a different address or alias to the one we hold already we may add to our details to aid quicker identification of you.
• Invitations to participate in market research
  In order to improve the service we offer to customers we may ask you to participate in research from time to time or feedback on the services we have provided you. It is entirely up to you whether you choose to do so.
• Subject to the appropriate controls, to help our service partners develop and improve the products and services they offer
  We may also share your personal data with our service partners to develop and improve the products and services they offer. Where possible the information will be provided in an anonymised way.

The personal data we process may include:

• Personal and contact details, such as name, age and contact details, including email address, telephone number and geographical location
• Proof of identity and/or personal data required for security purposes, including photograph and film images, CCTV footage
• Bank account/credit card details
• Record of goods or services provided to you, including preferences (dietary, access requirements)

Personal data that you share in content (e.g. on social media), when you contact us by letter, email, phone or other means when making an enquiry, providing survey feedback, making a comment or raising a complaint.  In limited circumstances, to support personal preferences, accessibility, and the services we offer you, we may also process special categories of data, for example if you are attending an event and have special dietary requirements for religious or health reasons. Special categories include:

• Racial or ethnic origin
• Sex life or sexual orientation
• Religious or philosophical beliefs
• Political opinion
• Health data

3. Lawful bases for processing

The law on data protection requires that, where we're processing your personal data, we must satisfy at least one prescribed condition for processing. These are set out in data protection law, and we rely on a number of different conditions for the activities we carry out:

• Necessary for the performance of a contract or to comply with law
  In most cases, the information described above will be provided to us by you because you want to use our services or engage with us, and our use of your information will be governed by contract terms. Giving this information to us is therefore your choice. If you choose not to give all or some of it to us, this may affect our ability to provide the services you want, to you. We may rely on this condition for processing in the following scenarios:
  • To enable you to access and use some of our services.
  • To let you know about significant changes to products, terms, or privacy policy.
  • To confirm your identity and authenticate the information you provide.
  • To process payments and collect arrears.
  • To provide and improve customer support.
  • To send you service communications.
  • To resolve complaints and disputes.
  • To comply with the law.
  • Investigation, detection, and prevention of crime.
    
    
• Consent
  We obtain your consent...
  
  We may also rely on your consent in the following scenarios:
  
  • Market research - we may send you invitations to submit feedback or participate in market research (see below). If you do so, your feedback is given with your consent.

    Please note that you can opt-out from us processing your personal data for marketing purposes at any time by clicking here. You can also email us at hoceventsteam@parliament.uk

  • Administration of offers, surveys and other promotional activities.
    
    
• Necessary in our legitimate interests or those of a third party
  We can also use personal information where the benefits of doing it are not outweighed by the interests or fundamental rights or freedoms of individuals. The law calls this the "Legitimate Interests" condition for processing. Where we rely on it, the benefits being pursued by us are:
  
  
  • Marketing
    To send you communications (whether by post or email), to create marketing content and refine our marketing strategies.
  • Fraud investigation, detection, and prevention
    Identifying and stopping fraud, including fraudulent access to our services.
  • Internal training purposes
    To enable us to train our staff to better provide services to our customers.
  • To maintain our records and other administrative functions
  • Reporting, analytics, and product development
    To provide management information and information to continue to provide our services efficiently, to help improve our services and communications, and those of our service partners. To develop our products. We create anonymous data for these purposes.
  • To help our service partners develop and improve the products and services they offer
  • To resolve complaints and disputes
    We need to use customer data when looking into queries and complaints.
  • To improve data accuracy and completeness
    When you engage with us or use our services you may supply us with information about yourself which we will use to improve our data accuracy and completeness across our wider business and enable us to provide the most accurate data for customers and clients.
  • Invitations to participate in market research
    In order to improve the service we offer to customers; we may ask you to participate in research from time to time. It is entirely up to you whether you choose to do so.

A further condition for processing is required when processing special categories of data as these require additional control. The condition will differ dependent on the circumstances but might include processing where we have your explicit consent to use the personal data or where it is necessary for substantial public interest.

In compliance with DPA 2018, our Appropriate Policy Document (pdf, 135KB) provides further information about the processing of special category and criminal conviction data.

4. Who we share your data with

We may disclose your personal data to other organisations where we have a lawful basis, or you have been given your consent to do so. We may also share your data with providers of goods and services who have contracts with us.

Examples may include:

• companies that supply technical solutions and business support
• email and subscription services (e.g. Mailchimp)
• the House of Lords administration (who is a separate organisation) for the provision of shared services to you
• Governmental and regulatory bodies such as HMRC, the National Audit Office, the Westminster Council Food Team and the Information Commissioner’s Office
• other organisations and businesses who provide services to us such as debt recovery agencies, back up and server hosting providers, IT software and maintenance providers, document storage providers and suppliers of other back office functions
• distribution services
• survey solutions

If you choose to subscribe to our services, we will use your information to send you updates about services you may be interested in. You can unsubscribe at any time.

For more information about who your data is shared with please contact hoceventsteam@parliament.uk.

5. Storage and security

We take the security of your personal data seriously. All personal data you provide to us will be stored securely, both physically and electronically, in accordance with our policies. We have an information security process in place to oversee the effective and secure processing of your personal data. Some personal data controlled by us are held outside the UK. These data are predominantly held in data centres within the European Economic Area (EEA), for the purpose of hosting and maintenance. Regulations under section 17A of the DPA 2018 specify that all countries within the EEA are regarded as providing an adequate level of data protection. If personal data are transferred to a country outside the UK or EEA, the adequacy of that country and the organisations and systems processing the data is assessed to ensure that appropriate safeguards are in place.

We will retain your personal data for as long as is necessary for the purpose it was collected. Retention periods can be found in the Houses of Parliament Authorised Retention and Disposal Policy (ARDP).

6. Your rights

You have certain rights over the personal data you provide to us, and we will ensure you can exercise these. You have the right to request:

• information about how your personal data is processed
• a copy of that personal data
• that anything inaccurate in your personal data is corrected
• in certain circumstances, you can request we erase the personal data we hold, or ask us to stop or restrict processing if you have an objection

If you would like to exercise any of these rights, please contact the Data Protection Officer using the contact details at the top of this notice.

7. Your right to complain

If you are unhappy with the processing of your personal data by the House of Commons Catering Service, please contact hoceventsteam@parliament.uk in the first instance. If you remain dissatisfied, you can contact the Data Protection Officer using the details at the top of this notice. If you remain dissatisfied, you also have the right to complain to the Information Commissioner’s Office. Further details about your rights can be found on the Information Commissioner’s website Your data matters | ICO.

8. Email alerts and subscriptions

If you sign up for our email subscription service, we will hold the information you submitted (such as your email address) for as long as we are providing you services.

You can unsubscribe from emails at any time by clicking the unsubscribe link at the bottom of each email, or by sending an email notifying us of your wish to unsubscribe. 

When you subscribe to an email alert or newsletter service, we collect:

• your name, email address, subscription preferences and any other information you choose to provide to us
• information about how you use our emails - for example whether you open them, and which links you click on
• details of which version of web browser you are using
• information on how you use the site, using cookies and page tagging techniques.

We will use the personal data you have provided to us to send you email alerts and gather feedback to improve our email alerts. We may also occasionally contact you to improve our service.

For more information, please refer to UK Parliament email privacy policy.

9. Changes to this notice

We may update this privacy notice from time to time. In that case the ‘last updated’ date below will also change. Any changes to this privacy notice will apply to you and your data immediately. If these changes affect how your personal data is processed, we will take reasonable steps to make sure you know.

This notice was last updated on 16/10/2023.