Privacy Policy

The HPAC demonstration site is not a live site and only contains data used to demonstrate the HPAC Library Management System and utilises membership (user) data of HPAC support staff. Temporary membership (user) data may be created to demonstrate HPAC to interested parties. HPAC is hosted by Durham County Council and is a partnership between Durham County Council and County Durham and Darlington NHS Foundation Trust.

Data Protection Act 1998 and GDPR 2016/679

HPAC complies with the Data Protection Act 1998 and with the General Data Protection Regulation 2016/679 (GDPR) by keeping personal data up to date; by storing and destroying it securely; by not collecting or retaining excessive amounts of data; by protecting personal data from loss, misuse, unauthorised access and disclosure and by ensuring that appropriate technical measures are in place to protect personal data. Only authorised employees and data processors required to deliver our services will have access to HPAC data. All parties who have access to HPAC data are required to process or use that data in accordance with the provisions of current data protection legislation. Data contained on HPAC will never be sold, traded, rented, exchanged or otherwise shared with any other person, company or organisation without explicit consent to do so.


The HPAC website uses security and safeguard measures to protect membership (users') information (e.g. Secure Sockets Layer encryption) to ensure that data is secure and protected against unauthorised access. There are no financial transactions on HPAC.


HPAC uses cookies. Cookies are small text files that are placed on your computer by HPAC and allows HPAC to remember who you are and what has been placed in your basket as you journey through the site. You have the ability to accept or decline cookies by modifying the settings in your browser. However, you will not be able to login to HPAC and order resources if cookies are disabled. You can also manually remove cookies from your system when you have finished a session on HPAC. For more information about cookies visit

Visitors to HPAC - registered and non-registered users

We use a third party service, Google Analytics, to collect visitor information and to follow visitor usage patterns. How visitors use various pages and journey through the site enables us to improve HPAC. The information is gathered in a manner which does not identify individuals and is shared with organisations who have purchased HPAC.

Membership (User) Data

For this HPAC Demonstration site County Durham and Darlington NHS Foundation Trust (CDDFT) is the data controller. As data controller CDDFT is required to have a legal basis when using personal information. CDDFT considers that performance of our tasks and functions are in the public interest. So when using personal information our legal basis is usually that its use is necessary for the performance of a task carried out in the public interest, or in the exercise of official authority vested in us. Durham County Council is the data processor. If you have any queries about membership or how your information is handled please contact your local library or resource service which can be found at the Contact Us link on the HPAC homepage.

What do we do with the information?

Data we hold will be used confidentially, and helps us to run our services and keep you informed - e.g. to email you information about new resources and publications and to let you know about events that may be of interest. You can opt into these services when you register and can opt-out at any time by logging into your account. We do not collect more information than we need to fulfil our services and will not retain it for longer than is necessary. Library/resource service staff and management staff will have access to this information. Durham County Council IT staff and County Durham and Darlington NHS Foundation Trust HPAC support staff will have access to this information for the purposes of HPAC system administration and support.

Joining as a service user

When you register online we ask you for your personal details including name and contact details. We will also ask you about your professional details and questions relevant to providing our service. When joining user login information, comprising a username, email address, and password is created and collected.

Retaining membership (user) data

Your membership data and details of transactions made through HPAC are retained for 2 years. If you do not use the service for a period exceeding 2 years your membership (user) data and all associated transactions will be deleted from the HPAC system.


Emails to HPAC users are sent from email servers located at Durham County Council. Emails may be about user/member administration, newsletters, communications about registration, resources ordered, borrowed or due for return such as books and teaching resources. HPAC does not use tracking on emails.