Privacy Notice

We ask that you read this privacy notice carefully as it contains important information on who we are, how and why we collect, store, use and share personal data, your rights in relation to your personal data and on how to contact us and supervisory authorities in the event that you have a query or complaint.

The Crown Estate Paving Commission (“the CEPC”) is committed to protecting the privacy and security of personal data. The purpose of this notice is to promote transparency in the use of personal data and to outline how the CEPC collects and uses data in accordance with the General Data Protection Regulation 2016 (“GDPR”) and the Data Protection Act 2018 (“DPA 2018”). The CEPC is the data controller under the GDPR and DPA 2018 and we will process your personal data in accordance with the GDPR and DPA 2018 at all times. You, as a ‘data subject’, therefore have specific rights to the data that we hold, collect and process.

  1. Personal data we may collect from you
  2. Personal data others may share with us about you
  3. Where we store and process your personal
  4. Uses made of your personal data
  5. Lawful bases for processing
  6. How long we keep your personal data
  7. Your rights
  8. IP Addresses
  9. Contact our Data Protection Officer
  10. Cookies Policy

The Crown Estate Paving Commission is a statutory body whose functions and powers are set out in a number of Acts of Parliament:

5 George IV Cap. 100 – 1824
6 George IV Cap. 38 – 1825
9 George IV Cap. 64 – 1828
2 & 3 William IV Cap. 56 – 1832
14 & 15 Victoria Cap. 95 – 1851

The Commission’s role is to manage and maintain the streets, pavements and gardens of the Crown Estate around Regent’s Park and to maintain the Waterloo Gardens at Carlton House Terrace. It currently provides street cleaning, security patrolling and parking regulation services in its area of operation. The Commission is a rating body drawing its income from rates levied on Crown Estate leaseholders within its areas of responsibility. It operates and is financially independent of The Crown Estate, The Royal Parks and the local authorities.

The website is run and operated by the CEPC which is the controller of your personal data. The e-mail address is

Personal data provided to us via this website will be held and used in accordance with this Privacy Notice, the Privacy and Electronic Communications (EC Directive) Regulations 2003 and the General Data Protection Regulation (2016).

Personal data we may collect from you:

We may collect personal data from you in the following ways:

  • When you contact us in relation to the rates that we set for properties on the Regent’s Park
  • For residents we collect personal contact details such as name, address, telephone numbers and personal/work email addresses, staff contact details and managing agents details.
  • When you contact us in relation to parking on the estate whether you are a resident or contractor who is working on the estate.
  • When you apply to join the Commission.
  • When you contact us in relation to a garden subscription to Park Square and Park Crescent Garden.
  • When you contact us in relation to holding an event in Park Square, Park Crescent or Carlton House Terrace or elsewhere on the Regent’s Park estate.
  • When you make a phone call or send an e-mail to us seeking information about us or our services.
  • When you contact us about recruitment and employment.
  • When you have made a referral or been referred to us via any method whether directly or indirectly.
  • When you have used our services.
  • Through our use of Cookies on our website (please see the Cookies section below).
  • Through you contacting us with enquiries and comments.

If you take one of the steps mentioned above, we may collect and process personal data about you such as:

  • Your name, address, email address and other contact information.
  • Records of your correspondence with us, if you have contacted us.
  • Third party information such as lawyers, accountants, managing agents etc who contact us on your behalf.
  • If you are a contractor we will collect details relating to where on the estate you are working and your vehicle and company details.
  • Details of your visit to the website.
  • Multimedia files such as photographs and video footages.
  • Information and comment about your service user experiences.
  • Any other information provided to us when you contacted us and use our services.

Personal data others may share with us about you:

We never buy personal data from third parties or trade data with other organisations. However, there are times when we have to collect additional data from you or about you to help us deliver our services to you and we may share your personal data with our appointed representatives such as lawyers, valuers or debt collectors. We may also, with your consent collect personal data from third parties nominated by you to engage with us such as estate agents, managing agents and lawyers.

Where the CEPC engages a third party to process personal data we do so on the basis of a written contract which conforms to the security requirement of the GDPR and DPA 2018.

Where we store and process your personal data:

The personal data that we collect from you may be transferred to, and stored at, our servers in the UK. It may also be processed by persons operating in the European Economic Area (EEA) who work for us or an organisation we have instructed. If we do send your personal data outside the EEA or in cases where it is stored and/otherwise processed outside the UK or EEA in a country which does not offer an equivalent standard of protection to the UK or EEA, we will take all reasonable steps necessary to ensure that the recipient implements appropriate safeguards designed to protect your personal data (for instance, entering into the standard contractual clauses or relying on the Privacy Shield).

If you have any questions about the transfer of your personal data, please contact us at

Uses made of your personal data:

We will process any of your personal data, in accordance with our obligations under applicable data protection laws and regulations, for the following reasons: to provide you with the services you have requested; to comply with applicable laws and regulations; for administrative purposes; to assess enquiries; and to provide you with information about us and our services.

We may contact you by telephone, email, text, social media or other electronic means depending on the communication preferences you have previously indicated.  If, at any time, you do not wish to receive further information about us and our services, contact us at

Lawful bases for processing:

We are required to rely on one or more lawful basis to collect and use the personal data that we have outlined above. We consider the bases listed below to be relevant:

(a) Legitimate interests

Where applicable law allows us to use personal data for our or another person’s legitimate interests, and the use of your personal data is fair, balanced and does not unduly impact your rights.

We rely on this basis to process your personal data when we believe that it is more practical or appropriate than asking for your consent. Where you provide information, we will rely on the legitimate interest basis to communicate with you in most instances.

(b) Consent

Where we ask for your consent for our use of your personal data for a specific purpose. You always have the right to withdraw your consent.

(c) Contract

Where it is necessary to use your personal data to fulfil a contract with you     or to take steps at your request prior to entering into one.

(d) Legal obligation

Where the processing of your personal data is necessary for us to comply with a legal obligation to which we are subject.

How long do we keep your personal data:

The GDPR and DPA 2018 require that personal data should be kept for no longer than is necessary for the purposes for which the personal data are processed (except in certain specific and limited instances):

  • To comply with any statutory or regulatory requirements we are subject to under applicable law.
  • To fulfil the purposes for which the personal data was collected.
  • To defend our or a third party’s legal rights.
  • For instance, we will normally keep personal data if you are a resident of the estate for as long as you remain so on our CRM system which enables us to contact you should we need to. If you move away from the estate we will generally remove your personal data from our records six years after the date that it was collected. If you are a contractor we will generally remove your data after twelve months.

If you have any questions about our retention periods, please contact us at

Disclosure of your personal data:

We may disclose your personal data to third parties if we are under a duty to disclose or share your personal data in order to comply with any legal obligation, or in order to enforce or apply any agreements; or to protect the rights, property, or safety of the CEPC, or others. This includes exchanging information with other organisations for the purposes of safeguarding or other statutory regulations we have to comply with.

Your Rights:

Where we rely on your consent to use your personal data, you have the right to withdraw your consent.

When we use your personal data you have the right to:

  1. Ask us for confirmation of what personal data we hold about you, and to request access to a copy of that information. If we are satisfied that you have a right to see this personal data, and we are able to confirm your identity, we will provide you with this personal data.
  2. Request that we delete the personal data we hold about you, as far as we are legally required to do so.
  3. Ask that we correct any personal data that we hold about you which you believe to be inaccurate.
  4. Object to the processing of your personal data where we: (i) process on the basis of the legitimate interests ground; (ii) use the personal data for direct marketing; or (iii) use the personal data for statistical purposes.
  5. Ask for the provision of your personal data in a machine-readable format to either yourself or a third party, provided that the personal data in question has been provided to us by you, and is being processed by us: (i) in reliance on your consent; or (ii) because it is necessary for the performance of a contract to which you are a party; and in either instance, we are processing it using automated means.
  6. Ask for processing of your personal data to be restricted if there is disagreement about its accuracy or legitimate use.

If you decide you do not want to receive any further emails from CEPC, please tell us and we will remove you from the mailing list. At any point you can request to unsubscribe from our mailing list by contacting us using the details listed below.

Please note that where you ask us to delete your personal data we will maintain a skeleton record comprising your name and contact details to ensure that we do not inadvertently contact you in the future.  We may also need to retain some financial records for statutory purposes.

If you would like to exercise any of your rights, then please contact us at

IP Addresses:

The CEPC may collect information about your computer, including where available your IP address, operating system and browser type, for system administration. This is statistical data about our users’ browsing actions and patterns and we do not intend to use it to identify any individual.

Changes to the CEPC’s Privacy Notice:

This privacy notice was last updated on 15th August 2019. The CEPC reserves the right to vary this privacy notice from time to time. Such variations become effective on posting on this website. Where there are significant changes to this privacy notice, we will use all reasonable efforts to contact you however, the GDPR does not require us to obtain acceptance or consent from individuals for our Privacy Notice.


Questions, comments and requests regarding this privacy notice should be addressed to

We hope that you will never need to, but if you do want to complain about our use of personal data, please send an email with the details of your complaint to making clear the nature of your enquiry. We will look into and respond to any complaints we receive.

You also have the right to lodge a complaint with the UK data protection regulator, the Information Commissioner’s Office (“ICO”). For further information on your rights and how to complain to the ICO, please refer to the ICO website

If you need further information about the CEPC and how we manage your personal data please visit our Cookies Policy

Crown Estate Paving Commission’s Cookies Policy:

The CEPC’s website uses cookies to record visits to the website. This helps us to improve the website and provide you with a good experience when you browse the website.
Our website uses cookies which allow us to monitor the use of our website. This is for general purposes only. We do not use any other third party cookies.

For more information about cookies and the type of cookies our website uses, see the frequently asked questions we have prepared below.

What is a cookie?

A cookie is a small text file which is generated by a website and stored in a folder on your computer. The cookie stored is unique to your computer.

Why are cookies needed?

Cookies are needed to make websites work better. For example when you log into a webmail service such as Hotmail or Gmail a cookie is generated that confirms you are logged in. When you log off the cookie is deleted. This means if someone goes back to your webmail address they will not be able to read your emails.

Why does the Crown Estate Paving Commission use cookies?

The Crown Estate Paving Commission uses Google Analytics and WordPress cookies to record visits to the website. This helps us to identify which parts of the website are popular and which are less so.

Google Analytics allows us to recognise and count the number of visitors and to see how visitors move around the site when they are using it. These analytics programmes also tell us, on an anonymous basis, how people reached this site (e.g. from a search engine) and whether they have been here before. Google analytics policy can be found here