Privacy Notice
Last updated: October 2026
This Privacy Notice explains how Castletown Town Commissioners collects, uses, shares and protects personal data, how long information may be retained and the rights individuals have under the Data Protection Act 2018 and Applied GDPR.
Who we are
Castletown Town Commissioners (“the Authority”) is a local authority in the Isle of Man and is the controller of personal data processed in connection with its functions and services.
The Authority processes personal data in accordance with the Data Protection Act 2018, Applied GDPR and other applicable legislation.
Contact us
The Authority can be contacted at:
Castletown Town Commissioners
Town Hall
Farrants Way
Castletown
IM9 1NR
The Authority has a temporary Acting Data Protection Officer. Enquiries concerning data protection or the exercise of your data protection rights can be directed to the Authority at the above address.
Our approach to personal data
The Authority is committed to handling personal data lawfully, fairly and transparently and to protecting the privacy and security of the information entrusted to it.
We will only collect and use personal data where there is an appropriate purpose and lawful basis for doing so.
Collection and use of personal data
Types of personal data – The personal data processed by the Authority will depend upon the service or function concerned and may include identification and contact information, correspondence and communications, employment information, financial and payment information, housing and service records, complaints and enquiries, information rights records, and other information required in connection with the Authority’s statutory functions and services.
The personal data we collect and use will depend upon your relationship with the Authority and the services or functions concerned.
The Authority may process personal data for purposes including:
- staff and employment administration;
- payroll, pensions, accounts and financial administration;
- administration of public sector housing;
- delivery and administration of local authority services;
- exercising statutory functions and responsibilities;
- dealing with enquiries and complaints;
- responding to Freedom of Information requests, Subject Access Requests and other information rights matters;
- governance, meetings and committee administration;
- correspondence and communications;
- managing contracts and service providers;
- legal, regulatory and audit requirements; and
- enquiries, reviews or investigations undertaken in connection with the Authority’s functions.
Personal data may be obtained directly from you, generated through your dealings with the Authority, or obtained from other organisations or individuals where appropriate and lawful.
Providing personal data to the Authority
In some circumstances, the Authority may require personal data from you in order to fulfil a statutory function, comply with a legal obligation, administer a service or enter into or perform a contract.
Where information is required, we will explain this where appropriate. Failure to provide necessary information may affect the Authority’s ability to provide a service, administer a request or fulfil the relevant function.
Lawful basis for processing
The Authority processes personal data where there is an appropriate lawful basis. Depending upon the circumstances, this may include where processing is necessary:
- to perform a task carried out in the public interest or in the exercise of official authority;
- to comply with a legal obligation;
- for the performance of a contract or to take steps before entering into a contract;
- to protect an individual’s vital interests; or
- where another lawful basis under the Data Protection Act 2018 and Applied GDPR applies.
The Authority does not generally rely on consent where personal data is processed for the exercise of its statutory functions, compliance with legal obligations, the performance of public tasks, or the administration of its services. Where another lawful basis applies, it will not normally be necessary to obtain your consent before processing or sharing personal data.
Where the Authority relies upon consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.
Special category personal data
The Authority may process special category personal data, including health information, where this is necessary in connection with its functions and permitted by law.
Special category personal data is subject to additional protections and will only be processed where an appropriate lawful basis and applicable condition for processing are satisfied.
Sharing personal data
The Authority does not sell personal data.
Where necessary and lawful, personal data may be shared with organisations or individuals providing services to or acting on behalf of the Authority. This may include:
- professional advisers and consultants;
- human resources advisers;
- legal advisers;
- IT and other service providers;
- auditors and investigators;
- other local authorities;
- Isle of Man Government departments;
- regulatory and supervisory authorities; and
- law enforcement or other public authorities where required or permitted by law.
Where an organisation processes personal data on behalf of the Authority, appropriate contractual and data protection arrangements will be put in place. This is consistent with Isle of Man Information Commissioner guidance on the use of processors and controller-processor contracts.
How we protect personal data
The Authority takes appropriate organisational and technical measures to protect personal data against unauthorised access, loss, disclosure, alteration or destruction.
Access to personal data is restricted according to operational requirements.
The Authority may also use contracted IT, cloud and other service providers to store or process information on its behalf, subject to appropriate contractual and data protection arrangements.
How long we retain personal data
The Authority retains personal data only for as long as necessary for the purposes for which it is held, taking account of applicable legal, regulatory, administrative and operational requirements.
The Authority is reviewing and documenting its retention arrangements as part of its ongoing data protection governance programme.
International transfers
The Authority does not routinely transfer personal data outside the Isle of Man, the United Kingdom or other jurisdictions recognised as providing appropriate data protection safeguards.
Where it is necessary to transfer personal data internationally, the Authority will ensure that appropriate safeguards are in place in accordance with applicable data protection legislation.
Your rights
Depending upon the circumstances, you may have rights including:
- access to your personal data;
- rectification of inaccurate or incomplete personal data;
- erasure of personal data;
- restriction of processing;
- objection to processing;
- data portability;
- withdrawal of consent where consent is relied upon; and
- rights relating to automated decision-making.
These rights are subject to the circumstances and to any restrictions or exemptions provided by law.
The Authority does not currently undertake automated decision-making or profiling.
Requests to exercise your data protection rights should be made to the Authority or its Data Protection Officer.
Complaints
If you have concerns about the Authority’s handling of your personal data, you can raise these with the Authority in the first instance.
You also have the right to complain to the Isle of Man Information Commissioner, which regulates and enforces data protection legislation in the Isle of Man.
Website and cookies
The Authority’s website uses cookies. Cookies are small files stored on your device which may be used to support the operation and functionality of the website.
The website may contain links to external websites. The Authority is not responsible for the privacy practices of those external websites and you should review their privacy information separately.
Changes to this Privacy Notice
The Authority will review this Privacy Notice periodically and update it where necessary to reflect changes in legislation, services or the way personal data is processed.
Last updated: October 2026.