Privacy Notice for House of Commons Catering Services

1. About us
2. The personal data we collect
3. Lawful bases for processing
4. Who we share your personal data with
5. Storage and security
6. Your rights
7. Your right to complain
8. Email alerts and subscriptions
9. Changes to this notice

1. About us

We are the House of Commons, London, SW1A 0AA - which we’ll refer to as “HOC” in this notice. The Corporate Officer (Clerk of the House) is the Controller of any personal information processed as described in this Privacy Notice.

We have a Data Protection Officer, the Head of Information Compliance, who ensures that the day-to-day obligations of the Data Protection Legislation are met. If you have any questions about this Privacy Notice, or if you wish to exercise your rights or contact the Data Protection Officer, you can:

• Email: hcinformationcompliance@parliament.uk
• Telephone: +44 (0)20 7219 4296
• Write to: Information Compliance Service, House of Commons, London, SW1A 0AA (marking it for the attention of the Data Protection Officer).

The Information Compliance Service is responsible for HOC’s compliance with Data Protection Legislation by ensuring requests are handled appropriately and information is made publicly available where necessary.

2. The personal data we collect

We will need to ask you for certain personal information to deliver the services you have asked for and to give you the best possible experience when you engage with us and when you use our products and services.

Most of the personal information we process is provided to us directly by you for one of the following reasons:

• You make an enquiry or complaint, or provide feedback.
• You attend or register for an event.
• You make a table reservation in one of our restaurants.
• You subscribe to a newsletter.
• You represent an organisation at an event.
• You nominate someone for an award.
• You complete forms, such as event orders, catering requests, or accident/incident reports.

We process your personal data to:

• Enable you to access and use some of our services
  We will use your information to accept you as a new/returning customer. We will also use it to provide you with our products and services or fulfil a contractual agreement between you and us to provide you with commercial activities and services.
  
  
• Communicate significant changes to products, terms, or policies
  We will let you know by email if there are significant changes to our products, their features, our terms, or our privacy policy.
  
  
• Confirm your identity and authenticate information
  As part of providing some services to you we will confirm your identity and authenticate the information you provide for security purposes. Establishing your identity is important and we must be sure you are who you say you are. Identity checking may also involve checking the registration information you give us against information we already hold about you and potentially publicly available information about you such as from social media and/or from company websites.
  
  
• Process payments and collect arrears
  We will use your information to process the payments you commit to when signing up to events or ordering hospitality in meeting rooms and for the collection of any future payments or overdue amounts for those services.
  
  
• Provide and improve customer experience
  We will use your information to be able to provide and improve the customer experience we provide to you.
  
  
• Administer offers, surveys, and promotions
  From time to time we will run promotions and surveys and, we will use the personal data you provide to us, to run such activities and to do what we agree to do as part of them.
  
  
• Marketing
  We will use the personal data we hold about you for marketing purposes in 2 ways:
  
  
  • To send marketing communications.
    

    You can opt ot at any time by clicking here emailing hoceventsteam@parliament.uk

  • To create marketing content and to refine our marketing strategies.
    
    
• Send service communications
  We will use your information to contact you to tell you about changes to or issues affecting the services you are taking.
  
  
• Comply with legal obligations
  Like any other business, we are required to comply with many laws and regulations. Where necessary (i.e. where it is reasonable and proportionate for us to do so), we will use your personal data to the extent required to enable us to comply with these requirements.
  
  
• Investigate, detect, and prevent crime (excluding fraud)
  We may use your information for the investigation, detection, and prevention of crimes (other than fraud).
  
  
• Deliver internal training to staff
  We will use your information to ensure that our teams have the knowledge and expertise they need to ensure we provide the best possible experience to our customers when interacting with us.
  
  
• Perform reporting, analytics, and product development
  We will use your information and how you respond to our emails to understand you, and how you use our services. We can, where applicable, combine this with information provided by third parties or other teams at UK Parliament. This analysis or the data will be used to enable us to continue to provide our services efficiently, in the sending of communications, to improve and promote our products and services, develop new products, to provide educational content, generate consumer insight and to provide appropriate levels of support to our customers.
  
  
• Maintain accurate records and support administrative operations
  Like any other business, we need to ensure that we maintain comprehensive and up to date records of the ways we process your personal information and other operational activities and therefore we will process the information you provide for record-keeping, updates, and general administrative purposes.
  
  
• Resolve complaints and disputes
  Whilst we try to make sure that you are happy with the service we provide and do not feel the need to complain, if you do complain to us, we will use the information we have about you to help us manage your complaint.
  
  
• Improve data accuracy and completeness
  Personal information you provide to us when you access and use some of our services may be used to improve the information we already hold about you e.g. you provide a different address or alias to the one we hold already we may add to our details to aid quicker identification of you.
  
  
• Invite you to participate in market research
  In order to improve the service we offer to customers we may ask you to participate in research from time to time or feedback on the services we have provided you. It is entirely up to you whether you choose to do so.
  
  
• Subject to the appropriate controls, to help our service partners develop and improve the products and services they offer
  We may also share your personal data with our service partners to develop and improve the products and services they offer. Where possible the information will be provided in an anonymised way.

The personal data we process may include:

• Personal and contact details (e.g., name, age, email address, telephone number, geographical location).
• Proof of identity and security-related data (e.g., photographs, CCTV footage).
• Bank account/credit card details.
• Records of goods or services provided, including dietary and access requirements.
• Personal data shared via content submissions or communications with us.
• Record of goods or services provided to you, including preferences (dietary, access requirements).

In limited circumstances, to support personal preferences, accessibility, and the services we offer you, we may also process special categories of data, for example if you are attending an event and have special dietary requirements for religious or health reasons.

Special categories include:

• Racial or ethnic origin
• Sex life or sexual orientation
• Religious or philosophical beliefs
• Political opinion
• Health data

Where special category data is processed, this will be done under an appropriate lawful basis as explained in Section 3.

3. Lawful bases for processing

The law on data protection requires that, where we're processing your personal data, we must satisfy at least one prescribed condition for processing. We rely on several lawful bases for processing your personal data:

• Necessary for the performance of a contract or to comply with law
  We process your personal data to deliver services you request or where required by law. If you choose not to provide certain information, this may affect our ability to provide some services.
  
  Examples include:

• Managing event bookings.
• Sending updates about products or policies.
• Identity verification and authentication.
• Payment processing.
• Service communications.
• Complaint and dispute resolution.
• Compliance with legal obligations.
• Crime prevention (excluding fraud).
  
  
• Consent
  We seek your consent to collect and process information necessary to manage your event booking, ensure security compliance, meet regulatory obligations, and maintain the operational integrity of our venues and outlets.
  
  Where information is essential to deliver our services safely, lawfully, or effectively, you may be required to provide it.
  
  In all other cases, providing your consent is voluntary and is not a condition of receiving our services. We will make clear where information is optional.
  
  We may also rely on your consent for:
  
  
  • Sending marketing communications.

• • Admnistration of offers, surveys, and promotional activities.
  • Invitations to participate in market research.

• Necessary in our legitimate interests or those of a third party
  We can also use personal information where the benefits of doing it are not outweighed by the interests or fundamental rights or freedoms of individuals. The law calls this the "Legitimate Interests" condition for processing.
  
  Examples include:
  
  
• Sending direct marketing communications.
• Investigating and preventing fraud.
• Internal training to improve customer service.
• Maintaining operational and administrative records.
• Reporting, analytics, and product development (using anonymised data where possible).
• Assisting service partners to improve their offerings.
• Improving data accuracy and completeness.
• Resolving customer queries and complaints.

Special categories of personal data

A further 'condition for processing' is required when processing special categories of personal data as these require additional control. The condition will differ dependent on the circumstances but might include processing where we have your explicit consent to use the personal data or where it is necessary for substantial public interest.

In compliance with DPA 2018, the House of Commons Special Category and Criminal Convictions Data Processing Policy provides further information about the processing of special category and criminal conviction data.

In limited circumstances, we may process personal data necessary in emergency circumstances, for example, to protect an individual’s vital interests or for the provision of health or medical services.

4. Who we share your personal data with

We may disclose your personal data to other organisations where we have a lawful basis, or you have been given your consent to do so. We may also share your data with providers of goods and services who have contracts with us.

Examples include:

• Other UK Parliament departments (e.g., House of Lords, Parliament Shop, Participation Team).
• Providers of contracted services (e.g., AV services, floristry, subscription providers like Mailchimp).
• Health and Safety Executive in case of incidents.
• Governmental and regulatory bodies (e.g., HMRC, National Audit Office, Westminster Council).
• Suppliers supporting IT, hosting, and document management functions.
• Debt recovery agencies (if applicable).
• Distribution service providers.

Where external suppliers act as our data processors, they are bound by written contracts to process personal data only in accordance with our instructions and applicable law.

If you subscribe to our services, we will send you updates, and you can unsubscribe at any time.

We will not share your information with third parties for their own marketing purposes.

Events hosted by external organisations

If you attend an event on behalf of an external organisation or individual, please be aware that they may collect and distribute personal data such as images, videos, or sound recordings. These may be published via their websites, social media channels, or organisational materials.

If you wish to opt out of such recordings, please contact the event organiser directly prior to the event.

Please note that the House of Commons is not responsible for, and has no control over, the collection, use, or distribution of personal data by external organisations hosting events on the Parliamentary Estate. However, filming and photography must comply with the House of  Commons Filming and Photography Rules at Events.

5. Storage and security

We take the security of your personal data seriously. Data is stored securely, both physically and electronically, in accordance with our policies.

Some personal data is hosted outside the UK but predominantly within the EEA, which the UK considers having adequate protections. Transfers outside the EEA are subject to additional safeguards.

Data is retained only for as long as necessary for the purpose it was collected. For full retention details, see the Houses of Parliament Authorised Retention and Disposal Policy (ARDP) (pdf, 1MB).

6. Your rights

You have rights over your personal data, including the right to:

• Request information about how your data is processed.
• Access your personal data.
• Correct inaccuracies in your personal data.
• Request erasure or restriction of processing in certain circumstances.

To exercise your rights, contact the Data Protection Officer using the details provided above.

7. Your right to complain

If you are dissatisfied with how we process your personal data, you can:

• Contact hoceventsteam@parliament.uk initially.
• Escalate to the Data Protection Officer if unresolved.
• Complain to the Information Commissioner’s Office (ICO) via For The Public | ICO (external website).

8. Email alerts and subscriptions

If you sign up for our email services, we collect:

• Your name, email address, and preferences.
• Information about how you interact with our emails (e.g., whether you open them).
• Browser details and site usage data (via cookies and page tagging).

You can unsubscribe at any time via the link at the bottom of each email or by contacting us.

For further information, see the UK Parliament Email Privacy Policy.

9. Changes to this notice

We may update this privacy notice from time to time. Changes will take effect immediately. If changes significantly affect how your personal data is processed, we will take reasonable steps to notify you.

Version 2.2 - applies from 29/04/2025