Privacy Policy

Privacy Notice – Visit Maidstone 

This privacy notice explains how we process your personal data when you interact with us and information about your rights under data protection legislation. 
We reserve the right to update this privacy notice. Changes apply as soon as they are published. We recommend that you visit this page regularly to find out about any updates that may have been made. 

Page updated: 1 June 2026

Contact us 

We are Maidstone Borough Council of Maidstone House, King Street, Maidstone, Kent, ME15 6JQ. We are the “data controller”. This means that we are responsible for deciding how we hold and use your personal data. 

You can find us in the Information Commissioner’s register of organisations who have paid the data controller fee. Our reference number is Z4752882. 

If you have any questions about this privacy notice or if you would like to exercise your rights, please contact the Data Protection Officer: 

Maidstone Borough Council 
Maidstone 
Kent 
ME15 6JQ 

Phone: 01622 602000 
Email: Data Protection Officer 

Your rights 

You have rights under data protection legislation. Full details of these rights can be found on our data protection page. 
 
We normally have to comply when you tell us that you want to exercise your rights. There are some legal exemptions. These will be explained if an exemption applies to your request.  
There is no charge for you to exercise your rights. We may refuse your request or make a reasonable charge if your request is manifestly unfounded or excessive. 
 Before we deal with your request we may ask you for proof of your identity. After receiving your proof we will process your request as soon as possible. We will respond within one calendar month in most cases. 

How to complain 
If you are not happy with how we are processing your personal data, you can complain to us using the contact details above. If you are still unhappy after contacting us, you can contact the relevant competent supervisory authority - the Information Commissioner’s Office (ICO). You can contact the ICO: 
Information Commissioner’s Office 
Wycliffe House 
Water Lane Wilmslow 

Cheshire 
SK9 5AF 

Phone: 0303 123 1113 

 Visit their website 

Your obligations 

It is important that you tell us if your personal data changes while you are using our services. This will mean that the data we hold about you is kept up to date and accurate. 

Types of personal information we collect 

We process the following types of personal data: 

• Name 
• Email address 
• Phone number 
• Address 

If you use any of our social media pages or applications or you use one of our products or services that allow interaction with social media, we may receive information relating to your social media accounts. For instance: 

• If you click on a ‘like’, ‘+1’, ‘tweet’ or similar button on one of our websites or services, we may record the fact that you have done so. In addition, the content that you are viewing may be posted to your social network profile or feed. We may receive information about further interactions with this posted content (for example, if your contacts click on a link in the posted content), which we may associate with the details that we store about you. 

• If you ‘like’, ‘+1’ or similar one of our pages on a social media site, we may receive information about your social media profile, depending on your social media account privacy settings. 

For more information and for details about how you can control access to your social media profile, you should view the privacy policy and other guidance available on the relevant social media website. 

Where you have uploaded product reviews, comments or content to our websites or services and made them publicly visible, we may link to, publish or publicise these materials elsewhere including in our own advertisements. 

Each time you create or reply to a post or thread on a website forum from us, in addition to providing this forum service, we may also record the forum name and the time and date of your post or thread with your account details. We do this to better understand the ‘typical users’ of our forums and to select or tailor our marketing communications to reflect your forum activity. We do not use the actual content of your forum posts or threads for purposes of sending marketing communications. 

Why we have your personal data and how we get it 

We use your personal data to: 

• provide you with services at the Creative Maidstone Community Arts Hub and to run events such as the Heart of Kent Walking Festival and other events listed on the Visit Maidstone website 
• retain a record so we can audit, and quality assure our services, and to inform decision-making about our services 
• plan and manage our services and to meet the requirements of external regulators. 

 We also use cookies and other analytic technologies to give you a better experience on our website and to improve the relevance of online advertising you see. For more information, please see our cookie notice. 

To keep visitors and staff safe, we use CCTV at our premises which records images. 

We may also use your personal information to contact you regarding user satisfaction surveys and for staying in touch. 

Marketing 

We may process information that you provide to us for the purpose of visitor registration, brochure requests, e-newsletters subscriptions and competition entry. This data may be processed for the purposes of sending you the relevant notifications and media.  

• E-newsletters - by completing our e-newsletter signup page you are agreeing to receive email marketing communications. These can be unsubscribed from at any time, simply by clicking the unsubscribe link at the bottom of the email.  
• Brochure requests - by completing our Brochure Request form you are agreeing to receive brochures from us. 
• Competitions - please check the individual terms and conditions associated with each competition.  

Keeping your personal data 

Personal data will be kept for 5 years from the end of the service being provided to you. This is to meet our customer service, accounting, and auditing requirements. 

CCTV footage will be kept for 30 days. 

Our lawful basis 
Our lawful basis to process your personal data is legitimate interests. 
Our lawful basis to capture CCTV images of members of the public is task in the public interest. 
 
Sharing your personal data 
 Your personal data will only be shared with other organisations when necessary and it will always be shared securely. We will only share your personal data if the law lets us and we always aim to share as little data as necessary. 

We may use other third-party service providers to provide certain data processing services for us (acting as our authorised data processors). Examples of authorised data processors could include billing and fulfilment partners, IT solution providers, and data analytics providers who process information on our behalf. For example, we may use the services of third parties to personalise content, fulfil orders, deliver packages, send postal mail and emails, send text messages (SMS), provide marketing assistance, process credit card payments, provide fraud checking services and provide customer services. 

When acting as our authorised data processors, our service providers are required to only process data in accordance with our instructions, in line with this privacy notice, and are subject to appropriate confidentiality and security obligations. 

The Council reserves the right to share personal data with other agencies and organisations for the purposes of prevention or detection of fraud. Our lawful bases to process your personal data for this purpose are legal obligation and task in the public interest. Our lawful basis for processing special category data for this purpose is substantial public interest. Our substantial public interest conditions are statutory and government purposes, preventing or detecting unlawful acts and preventing fraud. This includes the National Fraud Initiative Exercises and referrals to fraud and compliance for investigation. Dependent on the investigation, our lawful basis is in accordance with the following legislation: 

• Local Government Finance Act 1992 as amended 
• Council Tax Administration and Enforcement Regulations 1992 
• Local Government Finance Act 1988 as amended 
• Non-Domestic Rates Regulations 
• Non-Domestic Rates Act 2023 
• Local Audit and Accountability Act 2014 

When necessary, the Council will share personal data with anti-fraud and law enforcement agencies for the prevention and detection of crime, and it will always be shared securely. We will only share your personal data if the law lets us, and we always aim to share the minimal data as is necessary. When necessary, we share your personal data with: 

• Kent Intelligence Network 
• Other local authorities 
• Central Government, including Cabinet Office and Department of Work and Pensions 

• Law enforcement agencies, including the police 

• National Anti-Fraud Network – NAFN 
• Report Fraud  
• HM Courts (where a case progresses to the courts) 

We will share personal data with our parent department(s) in central government in line with statutory functions. 

As part of interagency initiatives and Maidstone Task Force we may share personal data with our partnership organisations. This may include: 

• Kent Police 
• Kent County Council 
• One Maidstone 
• housing associations  
• voluntary organisations  

We will only share your data when it is necessary and lawful for us to do so. 
 
Storing your personal data 
 
We store some of your personal data in the UK. The data you provide when you sign up to our e-newsletters is stored in the US by Granicus and Mailchimp.