Visit Monmouthshire

Monmouthshire County Council Data Privacy Notice

(Please see here if you would like to view the Monmouthshire Museums Team Privacy Statement)

Directorate: Enterprise
Service Area: Tourism
Contact Details:
Privacy Notice Name: Tourism Services

How we will use your information

This notice sets out the basis on which any personal data we collect from you from our website (, or that you provide to us by other means.

Types of personal information we may collect and hold on you:

• Contact information
• Transactional financial information – for purchases made via the eShop and in Chepstow Tourist Information Centre
• IP address information

Sources of your personal data
1 We may collect and process the following data on you:

1.1 Information that you provide by filling in forms on the website. This includes information provided by businesses, organisations and individuals, for appearing on the website, subscribing to our services (including to receive newsletters). We may also ask you for information when you enter a competition or promotion sponsored by us and when you report a problem with our website.

1.2 Information that we collect for the purposes of measuring tourism value and volume in Monmouthshire.

1.3 If you contact us, we may keep a record of that correspondence.

1.4 We may also ask you to complete surveys that we use for research purposes, although you do not have to respond to them.

1.5 Details of transactions you carry out through our website or in Chepstow Tourist Information Centre (TIC).

1.4 Details of your visits to the website including, but not limited to, traffic data, location data, weblogs and other communication data, whether this is required for our own billing purposes or otherwise and the resources that you access.

2. IP addresses and cookies

2.1 We may collect information about your device, including where available your IP address, operating system and browser type, for system administration and to report aggregate information to our advertisers. This is statistical data about our users' browsing actions and patterns, and does not identify any individual.

2.2 For the same reason, we may obtain information about your usage of our Website by using a cookie which is stored on the hard drive of your device. Cookies are used to make our Website work and to deliver a better and more personalised service. They enable us:

a. To estimate our audience size and usage pattern.

b. To store information about your preferences, and so allow us to customise our Website according to your individual interests.

c. To speed up your searches.

d. To recognise you when you return to our Website.

2.3 The cookies used on our Website are:

a. ASP.NET_SessionId - This cookie is essential for the operation and navigation of our Website. The cookie is deleted when you close your browser.

b. _utma, _utmb, _utmc, _utmz - These cookies are used by Google Analytics to collect information about how visitors use our site. We use the information to compile reports and to help us improve the site. The cookies collect information in an anonymous form, including the number of visitors to the site, where visitors have come to the site from and the pages they visited. To opt out of being tracked by Google Analytics across all websites visit

c. dmsTPC - This cookie is used to record if a user has accepted the use of Google Analytics cookies on the website. This cookie is deleted when you close your browser.

d. To find out more about cookies, including how to see what cookies have been set and how to manage and delete them, visit

2.4 This privacy policy does not cover the links within this site linking to other websites. We encourage you to read the privacy statements on the other websites you visit.

2.5 We may embed videos from our official YouTube channel using YouTube's privacy-enhanced mode. This mode may set cookies on your device once you click on the YouTube video player, but YouTube will not store personally-identifiable cookie information for playbacks of embedded videos using the privacy-enhanced mode. To find out more please visit YouTube's embedding videos information page: .

2.6 We may display either (or both) of the following widgets:

a. Feed widgets (widgets that display a feed from our social network page). These widgets do not create a cookie.

b. Sharing widgets (widgets such as Facebook Like, Twitter Share or AddThis) which enable you to share content of to your friends or followers. By default these do not create a cookie until you have clicked on the graphic or icon representing the sharing network you would like to use. By clicking the graphic or icon you consent to transmitting data to the respective social network.

Facebook's privacy policy on social plugins:
Twitter's privacy policy on cookies and information sharing: .
AddThis' privacy policy on cookies and information sharing: .

3. Where we store your personal data

3.1 As our servers are located in the United Kingdom, the data that we collect from you is obtained, processed, stored and transmitted in compliance with data protection legislation. By submitting your personal data, you agree to this transfer, storing or processing. We will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this privacy policy.

3.2 The transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to our Website; any transmission is at your own risk. Once we have received your information, we will use appropriate procedures and security features to try to prevent unauthorised access.

Purpose and legal basis for using your information

Purpose of the processing, legal basis for the processing and retention periods

4.1 We use information held about you in the following ways:

a. To ensure that content from our Website is presented in the most effective manner for you and for your device.

b. To provide you with information, products or services that you request from us or which we feel may interest you, where you have consented to be contacted for such purposes.

c. To carry out our obligations arising from any contracts entered into including through our Website.

d. To allow you to participate in interactive features of our service, when you choose to do so.

e. To notify you about changes to our service.

f. To regularly update you about our services and promotions in Newsletters.

4.2 We may also use your data to provide you with information about goods and services which may be of interest to you and we may contact you about these by email, text, mail or telephone.

4.3 Where we permit our affiliates to use your data, we (or they) will contact you only if you have consented to this.

4.4 We do not disclose information about identifiable individuals to our advertisers or other organisations, but we may provide them with aggregate information about our users (for example, we may inform them that 500 men aged under 30 have clicked on their advertisement on any given day). We may also use such aggregate information to help advertisers reach the kind of audience they want to target (for example, women in SW1). We may make use of the personal data we have collected from you to enable us to comply with our advertisers' wishes by displaying their advertisement to that target audience.

4.5 Our lawful bases for processing personal data:

a. Viewing our Website and sending us enquiries - Necessary for the public task performed in the public interest to promote economic well-being in Monmouthshire.

b. Bookings (with review requests) and eShop orders - Necessary for the performance of a contract.

c. Marketing/eNewsletters – Consent.

Your right to withdraw your consent

You have the right to withdraw your consent to the processing of information for marketing purposes. We operate an optional choice for receiving marketing communications and will clearly name any other organisations who may process your personal data. You can exercise your right to prevent such processing at any time by using the unsubscribe function on a received marketing email or by contacting us by email:, or telephone: 01633 644842.

Who will have access to your information?

The Data Controller for your information is Monmouthshire County Council.


Other Data Controllers may also be responsible for your information, depending on the specific circumstances. Please contact the Service Area for further information.

These are the departments we share your data with internally:

These are the agencies/ organisations we share your data with externally:
Monmouthshire’s destination marketing website is driven by one of Wales’ most comprehensive and up-to-date product databases (Wales Tourism Product Database) which also drives the website. United Kingdom organizations, including NVG, promoting tourism and local businesses, who use the Guestlink protocol (operated by NVG Ltd) to provide an entry on the Wales Tourism Product Database may process your business data. The lawful bases for processing your business data may be
‘Contract’, ‘Legitimate Interests’ or ‘Public Task’, depending on the organization and nature of the processing. This is processing you may reasonably expect, relating to your business presence on the organizations' websites and publications and your use of Guestlink.

As part of the processing, the organizations may contact your business about your use of Guestlink, updating your entry on the organizations' websites and publications, or how to use system features that could benefit your customer numbers or customer spend.

NVG (Ltd) may disclose your personal information to any member of their group, which means their subsidiaries, their ultimate holding company and its subsidiaries, as defined in section 736 of the UK Companies Act 1985.

They may disclose your personal information to third parties:

a. In the event that they sell or buy any business or assets, in which case they may disclose your personal data to the prospective seller or buyer of such business or assets.

b. If they or substantially all of their assets are acquired by a third party, in which case personal
data held by them about our customers will be one of the transferred assets.

c. If they are under a duty to disclose or share your personal data in order to comply with any legal obligation, or in order to enforce or apply our Terms and Conditions and other agreements; or to protect the rights, property, confidential information or safety of our Website, customers, affiliates or others and in particular if we are required to prevent any fraud or fraudulent transactions. This includes exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction.

Our website may, from time to time, contain links to and from the websites of our partner networks, advertisers and affiliates. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for these policies. Please check these policies before you submit any personal data to these websites.

Transactional financial information (relating to purchases made via Chepstow Tourist Information Centre and via the eShop) will be shared with Barclays Bank.

Requests for information

All recorded information held by Monmouthshire Council may be subject to requests under the Freedom of Information Act 2000, Environmental Information Regulations 2004 and General Data Protection Regulation including any other Data Protection law.

If the information you provide is subject to such a request, where possible Monmouthshire County Council will consult with you on its release. If you object to the release of your information we will withhold your information if the relevant legislation allows.

How long will we retain your information?

How long Monmouthshire County Council retains information is determined through statutory requirements or best practice.
Our retention periods for your personal data:

a. Operational Database records will be deleted on notification of closure of business or after 18 months of last use.

b. eMarketing Database records will be deleted after 24 months of last use, e.g. an email being sent.

Business records storage and publishing:

a. For storing and publishing business records on this website, our lawful basis for processing this data is “Public task”. The ICO website states the following, "the processing is necessary for you to perform a task in the public interest or for your official functions".

b. We store accommodation, venue and other business details (Trade Data) in our database to facilitate publishing them on this website. Our legal basis for this processing is part of our public task. Business details are, by their nature, already in the public domain and we are using them in a way the businesses would reasonably expect and could benefit from.


You have consented to your contact details being used for marketing purposes. You will / have been provided with details of the marketing that Monmouthshire County Council would like to carry out, together with any options such as how you would like to be contacted. You are able to withdraw your consent to marketing at any time by contacting the Service Area details on the top of this form.

Your Rights

Your rights under the General Data Protection Regulation are
• The right to be informed
• The right of access
• The right to compensation if Monmouthshire County Council fail to comply with certain requirements of General Data Protection Regulation in respect of your information.

The Act gives you the right to access information held about you. Your right of access can be exercised in accordance with the Act. From 25 May 2018, when GDPR becomes law, a reasonable Subject Access Request (SAR) can be made without a fee being charged. It will be carried out within one month. As part of a SAR, you may request that your personal data is corrected or deleted. The result of a deletion request may be affected by any outstanding bookings or orders in progress.

If you are not satisfied with our response you may contact the UK supervisory authority, the Information Commissioner’s Office, to report your concern.

For further information please refer to

Complaints Procedure

If you object to the way that Monmouthshire County Council is handling your data, you have the right to complain. Please contact the Service Area detailed at the top of this document outlining your issues. Please follow this link for further information on the complaints process.

If you remain unhappy you also have a right to complain to the Information Commissioner's Office


Privacy Notice No: TLCYTO001
Date Created: 25.05.18
Date Published: 25.05.18
Version Number: 1


Data Privacy Summary Notice

How we will use your information

Processing of your personal data by Monmouthshire County Council (MCC) is necessary to manage the destination of Monmouthshire and promote it to visitors. Without this information, the tourism service within MCC may not be able to fulfil its public task of promoting economic well-being.

Your details will not be shared with any internal departments or external organisations unless specified in the full privacy notice, or in relation to safeguarding or other legal obligations.

Your records will be safely stored and retained in line with our retention policy, unless we need to retain under another lawful basis.

You have a number of rights in relation to the information including the right of access to information we hold about you and the right to complain if you are unhappy with the way your information is being processed. 

Should you need to make a complaint about the way your data has been processed, please contact or if you are not fully satisfied you may contact the Information Commissioner’s Office online at or via their helpline: 0303 123 1113