Privacy Policy

This privacy notice tells you what to expect when the Royal Household collects, processes, shares and stores your personal data.

What information do we collect?

When you contact us:

Personal data you provide about yourself (for example, your name and contact details).

When a third party contacts us on your behalf:

Personal data provided by a third party such as your name, contact details and specific circumstances. This could be from friends, family, employers or government agencies

When you are invited to attend a Royal event or visit a Royal site either by us or a third party:

Your name and contact details;
On some occasions, we may also collect your date of birth and place of birth, and whether or not you have a criminal record (for security accreditation purposes), dietary requirements, details of any required special access arrangements, and details of your vehicle if applicable;
If you are eligible to bring a companion, we may also collect their information;
Your image may appear in footage from CCTV security cameras around the Royal residences, galleries and shops;

If you have an accident whilst visiting, we will ask you to complete an accident form on which we ask for your name, contact details, and nature of your injury.

When you meet a Member of The Royal Family, or their representative during a visit, reception or other event:

Information about you is usually provided to us by the organisation or body you are connected with or affiliated to.

When you supply goods or services to a Member of The Royal Family or their Household:

Your name, address, telephone number(s), email address, bank details and unique taxpayer reference (UTR) if applicable.

When you visit our website, or interact with us via social media:

Your IP address and browsing preferences and choices;
Your name and username and any comments that you make.

How do we collect it?

We may collect information about you from a number of sources these include:

From you when you contact or interact with us by telephone, email or post, or when you communicate with us through social media;
From forms we may ask you to complete;
From public sources;
From organisations/bodies you are connect to or affiliated with, when they provide your information to us for events/meetings or if you are meeting a Member of The Royal Family or their representative

Why do we collect it?

In some cases we collect the data out of a contractual necessity e.g. so both the Royal Household and you are fulfilling the obligations set out in our supplier terms and conditions or any contract that may be in place.

Other times we collect the data because it is a legitimate interest of the organisation to process the information, for example, to log any correspondence you send us and respond accordingly. We process visitor and guest information to be able to send out invitations for meetings or events, and to know who will be in our buildings for security and health and safety purposes. We use CCTV cameras at Royal sites for security reasons. We provide information to Members of The Royal Family, or their representative(s) so that they know who they will be meeting and why.

In other cases, we hold the information because you have given us your consent. If the basis for collecting and processing your data is based on your active consent, you also have the right to withdraw that consent at any time.

How do we use your information?

We process your data in order to:

Record any correspondence or gifts we receive and respond accordingly;
Send out invitations to meetings and events held on Royal sites;
Know who will be visiting Royal sites for security, and health and safety purposes;
Provide Members of The Royal Family, or their representative(s) with information about who they will be meeting and why;
Enter into contracts with suppliers and to pay them for goods and services received;
Maintain relationships with individuals and organisations with Royal affiliations such as those with Royal patronage or who hold a Royal warrant;
Send Royal messages and greetings;
Prevent and detect crime through use of CCTV footage;
Send press releases, operational notes and media advisories;
Assist with pre-employment checks.

How is it stored?

Your personal data is stored in a number of ways:

In paper files stored securely;
In software systems which are managed on the Royal Household network or by a third party supplier

Who do we share your information with?

We may share your data with and/or obtain information from some third parties:

Service providers

We work with selected service providers that carry out certain functions on our behalf, for example:

Contractors for the provision of events management services;
Stationery providers and other companies who produce event invitations for us;
Third party providers for the management of cookies on our website;
Social media providers e.g. Facebook, Twitter, Instagram – to deliver our social media presence;
The Royal Warrant Holders Association and Business in the Community in relation to managing applications for Royal Warrants of Appointment;
The Metropolitan Police Service and the respective County Constabularies who provide protection across the Royal Estate and to Members of the Royal Family.

Other organisations

We may share personal data with other organisations in the following circumstances:

Lord Lieutenants, where a Member of The Royal Family is visiting a particular county and the Lord Lieutenant is involved in the visit arrangements;
Our legal representatives e.g. solicitors, in order to establish, exercise or defend our legal rights;
Government departments or Independent Parliamentary Bodies, where we are required to by law or by a public authority or when such organisations are better placed to facilitate a response or to help resolve a query contained within a letter.
Police services in the provision of security services to the Royal Household.
The Diocese of London in relation to Safeguarding concerns.

How do we protect your data?

We take the security of your data very seriously. We have internal policies and controls in place to ensure that your data is retained appropriately, and is not accessed except by our employees or authorised third parties in the proper performance of their duties.

Where we engage or work with third parties to process personal data on our behalf, they do so, on the basis of written instructions, are under a duty of confidentiality, and are obliged to implement appropriate technical and organisational measures to ensure the security of data in line with the relevant legislation.

How long do we keep it for?

We retain your data in line with our retention schedules as agreed with the Information Assurance team of The Royal Household. Some personal data may be kept indefinitely as it is stored in the Royal Archives for reasons of historic interest.

The Royal Family website

The Royal Family web site, with the exception of the subscription system, does not store or capture personal information; it logs the user's IP address which is automatically recognised by the web server.

We do not use cookies for collecting user information and will not collect any information about you except that required for system administration of our web server.

If you register to receive updates, your information will be held on a secure server and the data will not be shared with any other organisation. This shall be treated as proprietary and confidential. It will be used only to provide you with e-mail updates on the topics you have requested.

Google Analytic Cookies

The Royal Family website uses the Google Analytics tool to track overall browsing patterns on the website. For instance, it helps us identify the most popular pages on the website, find out which links are being clicked on, and to give us broad demographics about from where, in the Commonwealth for example, users are accessing the site. We cannot personally identify any user with these cookies.

The five Google Analytics cookies are called utma, utmb, utmc, utmv and utmz. They track how often the website is visited, when you enter and leave the site, and which site you visited that lead you to royal.uk. utmz also tracks any keywords you entered into a search engine that lead you to royal.uk if appropriate.

What are my rights?

As a data subject, you have a number of rights. You can:

access and obtain a copy of your data on request;
ask us to change incorrect or incomplete data;
ask us to delete or stop processing your data, for example where the data is no longer necessary for the purposes of processing;
object to the processing of your data where we are relying on our legitimate interests as the legal ground for processing;
request a copy of the data you have provided to us in an agreed format, so that you can reuse it or transfer it to another data controller if you wish;
ask us if we use automated decision making or profiling when processing your data.

Please note that none of these rights are absolute and we reserve the right to refuse your request where exceptions apply.

Contact information and further advice

The Information Assurance team based at Buckingham Palace is responsible for ensuring compliance with data protection legislation across the Royal Household. If you would like to contact the Information Assurance team please email our Data Protection Manager at: [email protected], or write to: The Data Protection Manager, Information Assurance, The Royal Household, Buckingham Palace, London, SW1A 1AA.

The registered data controllers are as follows:

The Keeper of the Privy Purse is the Data Controller for the Household of TMs The King and Queen;
The Private Secretary is the Data Controller for the Household of TRH The Prince and Princess of Wales;
The Private Secretary is the Data Controller for the Household of HRH The Duke of York;
The Private Secretary is the Data Controller for the Household of TRH The Duke and Duchess of Edinburgh;
The Private Secretary is the Data Controller for the Household of HRH The Princess Royal;
The Private Secretary is the Data Controller for the Household of HRH Princess Alexandra;
The Private Secretary is the Data Controller for the Household of TRH The Duke and Duchess of Gloucester;
The Private Secretary is the Data Controller for the Household of TRH The Duke and Duchess of Kent.

If you have concerns about the use of your personal data, the Information Commissioners Office (ICO) is an independent body set up to uphold information rights in the UK. They can be contacted through their website: www.ico.org.uk or their helpline on 0303 123 1113, or in writing to: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

16 May 2023