Privacy Notice

About this notice

This notice explains how the National Association of Local Councils (NALC) handles personal data. It applies across our membership and member services, advice, guidance and support, enquiries, events, training, networks, publications, communications, website and digital services, representation, governance and related activities.

"Personal data" means information relating to an identified or identifiable living person. It includes obvious identifiers such as a name or email address and may also include online identifiers, location information and identification numbers. The processing of personal data is governed by the UK General Data Protection Regulation, the Data Protection Act 2018 and other applicable UK data protection law, together referred to in this notice as "data protection law".

Who we are

NALC is the data controller for the personal data described in this notice. This means that we decide why and how that personal data is processed.

In some activities, we work with organisations that process personal data for their own purposes or with us. These may include government departments, the Keeper of the Privy Purse at Buckingham Palace, county associations, One Voice Wales, the Society of Local Council Clerks, local authorities and other relevant sector or not-for-profit organisations.

Where another organisation determines its own purposes and means of processing, it is an independent controller and is responsible for its processing. Where another organisation and we jointly determine the purposes and means of processing, we may be joint controllers.

The personal data we process

Depending on how you interact with us, we may process some or all of the following categories of personal data:

Identity data — Name, title, username or similar identifier, date of birth where relevant, gender, photographs and video recordings.
Contact data — Postal address, email address, telephone number, organisation, council or association and role details.
Membership and Professional data — Membership status, council or association details, job title, responsibilities, professional interests, qualifications and information needed to provide member services or support.
Account and profile data — Account details, login credentials, preferences, interests, bookings, purchases, feedback and survey responses.
Financial data — Bank account, payment card and billing information.
Transaction data — Payments to and from you and details of services, events, publications or other items obtained from or supplied to NALC.
Technical data — IP address, login data, browser type and version, time zone and approximate location, device, operating system, platform and similar technical information.
Usage and Interaction data — Information about your use of our website and digital services, enquiries and feedback and, where NORA is used, questions, responses and conversation history.
Communications and marketing data — Correspondence with us and your preferences for receiving communications and marketing.
Employment and recruitment data — Information provided in applications or employment records, including work history, references, contractual details and academic or professional qualifications.
Governance and representation data — Information relating to office holders, committee or network participation, nominations, meetings, minutes, policy engagement and representative activity.

How we obtain personal data

We usually obtain personal data directly from you when you contact us, create or use an account, use our website or digital services, attend an event or training, participate in our networks or governance, subscribe to communications, make a payment, provide feedback or otherwise engage with us.

We may also receive personal data from member councils, county associations, relevant sector organisations, event partners, service providers, publicly available sources and other organisations where this is lawful and relevant. For example, an enquiry may be referred or shared with us by a county association or another relevant organisation so that it can be answered or appropriate support can be provided.

Special category personal data

Some personal data receives additional protection under data protection law and is known as special category personal data. This includes information about racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric identification, health, sex life or sexual orientation.

We process special category personal data only where it is necessary and where both a lawful basis and an additional legal condition apply. Depending on the circumstances, this may include explicit consent, employment or other legal obligations, substantial public interest, legal claims, protection of vital interests where consent cannot be given, or information that you have manifestly made public. We may use relevant information to monitor equality and comply with equal opportunities obligations. Where we seek explicit consent, we will explain the information required and why before asking for consent.

How we use personal data

We use personal data where necessary and proportionate for the following purposes:

Administering membership and providing member services.
Providing advice, guidance, information and support to members and others.
Receiving, referring, managing and responding to enquiries made directly to us or through county associations or other relevant organisations.
Creating and managing accounts, verifying identity where appropriate and controlling access to services.
Providing, supporting, securing and improving our website and digital services, including AI-supported services such as NORA.
Organising and delivering events, training, networks, conferences, meetings and publications.
Communicating with you about services, activities, campaigns, policy matters, events, publications and changes that may be relevant to you.
Seeking and analysing feedback, understanding how our services are used and improving their content, accessibility and performance.
Monitoring security, preventing fraud or misuse, investigating incidents and supporting the appropriate use of our systems and services.
Complying with legal, regulatory, financial, tax and other obligations and responding to lawful requests.
Representing the interests of local councils, conducting research and policy work and supporting NALC's governance and democratic processes.
Processing purchases, grants, bookings, refunds and other financial transactions.
Producing statistics, reports and analysis for planning, accountability and service development, using aggregated or anonymised information where appropriate.

Where we intend to use personal data for a materially different purpose, we will assess whether the new use is compatible with the original purpose and provide further information where required. We will seek consent where data protection law requires it.

Our lawful bases

The lawful basis we rely on depends on the context and purpose of the processing. We may rely on one or more of the following:

Contract — Where processing is necessary to enter into or perform a contract with you, including for purchases and event bookings.
Legal obligation — Where processing is necessary to comply with a legal or regulatory requirement, including financial, tax, employment and reporting obligations.
Legitimate interests — Where processing is necessary for NALC's legitimate interests as a membership association, provided those interests are not overridden by your rights and interests. Examples include delivering member services, responding to enquiries, supporting members and partners, operating and securing digital services, understanding how services are used and developing or improving them. Before relying on this basis, we consider the purpose, whether the processing is necessary and the likely impact on individuals, and balance our interests against their rights and interests.
Consent — Where you have freely given a specific and informed indication of your wishes. You may withdraw consent at any time, without affecting processing already carried out lawfully before withdrawal.

Digital services

Where you use our digital services, we may process information about your use of those services to provide, support, secure and improve them. This may include account, technical, usage, interaction and feedback information.

NORA is NALC's AI-supported digital service. NORA conversations are associated with your ReadyMembership account and can be accessed by authorised NALC staff where necessary to support and manage the service, review feedback, investigate issues and improve its performance. You can access your own NORA conversation history. NORA provides information and assistance in response to user questions. It does not make automated decisions about individuals.

Our AI technology providers process NORA data only to provide the service to NALC and do not use NORA conversations to train their general-purpose models.

Sharing personal data

We share personal data only where there is a lawful basis, and it is necessary and proportionate for the relevant purpose. Depending on the circumstances, recipients may include:

Other controllers, such as county associations, government departments, local authorities, One Voice Wales, the Society of Local Council Clerks and relevant sector, professional or not-for-profit organisations, where they process information for their own purposes.
Joint controllers, where NALC and another organisation jointly determine why and how personal data is processed, for example for a jointly organised sector activity.
Professional advisers, auditors, insurers, regulators, courts, law enforcement bodies and other public authorities where necessary or required by law.
Processors and service providers acting on our instructions, including providers of IT and information security, website and membership systems, communications, payment services, events and training platforms, digital services, data hosting and AI technology.

Processors may use personal data only under our instructions and contract, must protect it appropriately and may not use it for their own unrelated purposes. Independent controllers are responsible for their own processing and privacy information.

International transfers

Some of our service providers may process personal data outside the United Kingdom. Where personal data is transferred internationally, we comply with UK data protection law. We rely on an applicable adequacy regulation or put in place appropriate contractual or other safeguards, together with any additional measures required in the circumstances. Please contact us if you would like further information about the safeguards we use for international transfers.

Retention

We keep personal data only for as long as it is needed for the purposes for which it was collected, including to meet legal, regulatory, financial, tax, audit and reporting requirements, establish or defend legal claims and maintain appropriate organisational records. NALC maintains a retention schedule, and specific periods may differ between systems and processes.

Examples of our normal retention approach include:

Enquiries and associated correspondence are normally retained for five years.
NORA conversation histories are normally retained for 18 months so that users can refer back to previous conversations, including questions that arise on an annual cycle. They may be deleted earlier where appropriate.
Financial and transaction records are retained in accordance with applicable financial, tax and legal requirements.
Selected historic and governance records, including formal minutes and records of enduring organisational value, may be kept permanently where appropriate.
Information may be kept longer where required by law or necessary for actual or anticipated legal claims.

We review retained information periodically and securely delete or anonymise it when it is no longer needed. When deciding a retention period, we consider the amount, nature and sensitivity of the information, the risk of harm from unauthorised use or disclosure, the purposes of processing and whether those purposes can be achieved by other means.

Security

We use appropriate technical and organisational measures to protect personal data against accidental or unlawful loss, alteration, disclosure, access or destruction. Our measures include:

Physical access controls for our premises.
Maintaining Cyber Essentials certification.
Role-based and other access controls for information systems.
Appropriate procedures, staff awareness and supplier controls.
Technical measures, including encryption where appropriate, across our systems, networks and website.

Access to personal data is limited to people who need it for their role or service. We review security arrangements and respond to incidents in accordance with our legal and organisational obligations.

Your rights

Under data protection law, you have rights in relation to your personal data. Depending on the circumstances, these include:

The right to be informed about how we collect and use your personal data.
The right of access to the personal data we hold about you.
The right to rectification of inaccurate or incomplete personal data.
The right to erasure of your personal data in certain circumstances.
The right to restrict processing of your personal data in certain circumstances.
The right to data portability in certain circumstances.
The right to object to the processing of your personal data in certain circumstances, including where we rely on legitimate interests.
Rights relating to automated decision-making and profiling, where applicable.

You have an absolute right to object to the use of your personal data for direct marketing. You may also withdraw consent at any time where we rely on consent. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn. If you wish to exercise any of your rights, please contact us using the details below. We may need to verify your identity before acting on a request.

Contact details, complaints and changes

Please contact us if you have questions about this notice or if you have any concerns about how we have used your personal data so that we can address them. We will acknowledge data protection complaints within 30 days and investigate and respond to them without undue delay.

The Data Controller
National Association of Local Councils
The Bloomsbury Building
10 Bloomsbury Way
London WC1A 2SL

Contact form

For complaints, please contact us first if you have a concern about how we have used your personal data so that we have an opportunity to address it. You also have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection.

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF

Contact ICO

We may update this notice to reflect changes in our services, practices or legal obligations. The date of the latest update appears at the end of the notice. Where a change is significant, we will take reasonable steps to bring it to your attention.

Last updated: 1 October 2026