Introduction
To keep those of you who are interested in knowing about what exhibitions and other events are coming up at the Bailiffgate Museum & Gallery (the “Museum”) we need to hold some basic personal information about you. We also need to keep personal information if you have told us that we may contact you to help us with fundraising activities to keep our volunteer-run Museum going. We may also hold your personal information as part of the Museum’s collection. This policy aims to describe the ways in which we collect personal information and what we use it for.
Legal Background
This privacy policy sets out how we use, or “process”, any personal information we collect from volunteers or visitors. It is produced in compliance with the General Data Protection Regulations (GDPR) and the Data Protection Act 2018.
The GDPR states that personal data can only be processed if there is a legal ground to do so. The GDPR provides six legal grounds under which personal information can be processed lawfully and stipulates that an organisation’s privacy notice must include reference to this.
The lawful bases for processing are set out in Article 6 of the GDPR. At least one of these must apply whenever you process personal data:
(a) Consent: the individual has given clear consent for you to process their personal data for a specific purpose.
(b) Contract: the processing is necessary for a contract you have with the individual, or because they have asked you to take specific steps before entering into a contract.
(c) Legal obligation: the processing is necessary for you to comply with the law (not including contractual obligations).
(d) Vital interests: the processing is necessary to protect someone’s life.
(e) Public task: the processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law.
(f) Legitimate interests: the processing is necessary for your legitimate interests or the legitimate interests of a third party unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests. (This cannot apply if you are a public authority processing data to perform your official tasks.)
Information we collect
You give us your information when you, for example:
- become a volunteer or employee
- buy a ticket or an item online or in our shop using a debit or credit card
- complete forms for us including those on our website
- complete a visitor survey
- become a Friend
- sponsor an Object
- sign up for one of our events or workshops
- enter a competition
- make a donation
- complete a gift aid form
- communicate with us
- are captured on our CCTV when you visit the Museum
- sign up to receive emails from us.
You might also give us personal information if you kindly agree to provide documents, photographs or oral histories as part of our collection.
Data is collected about details of your visits to our website, for example traffic data, location data (including the country and telephone area code where your computer is located) and the resources that you access. Also, if you click on the "agree to cookies" pop-up the first time you enter our website we will store details about your page preferences for the purposes of enhancing and personalising your experience.
We keep a record of the emails and letters we send to you. We may also track whether you have opened emails to ensure we are sending you items of interest.
We will also collect information about your marketing preferences.
The information we hold about you might include, for example, your:
- name
- gender
- age
- National Insurance number if you are an employee
- medical information if you are an employee or volunteer
- postal address
- email address
- home and/or mobile telephone number
- preferences for how we communicate with you
- children’s names and ages (when entering into a competition)
- online retail purchases on our website
- gift aid status, and direct debit bank details where applicable.
Please note the lists above are not exhaustive. It might also include information which is publicly available.
We maintain a record of debit/credit card transactions online but we do not have access to your card number. For all transactions front of house in our shop the full sixteen-digit card number is on the merchant copy of the payment slip. This is never accompanied by your name or the three-digit number on the reverse of the card and is purely in case there is a transaction dispute. The slips are kept in the till until the end of the day, when they are transferred to a safe and from there to a locked office.
How do we use your data?
Depending on your relationship with the Museum we may use your data in the following ways:
- to advise that there has been a change to a booking you have made or you have won a competition
- to send you tickets for an event you have booked
- to assist in fundraising activities
- to provide you with information you have requested
- to process any donation you have made, including gift aid
- to advise you of news and updates about the Museum
- to undertake customer research to help us improve the exhibitions and events we offer
- to market relevant events to you which we think might be of interest
- to ensure we know how you prefer to be contacted
- to comply with any legal obligations
- to comply with any obligations placed under us by the Charity Commission
- to train our staff to continuously improve our services
- to add to our collection (for example if it is a photograph, document or oral history which contains personal data).
We may use personal information to provide visitors / volunteers with information about exhibitions, events, concerts and offers that may be of interest. We may use personal information to identify additional exhibitions and events that are likely to be of particular interest. We may also use it, to seek help in fundraising. The section below entitled "What choices do I have?" explains how visitors/volunteers can change whether to receive this information.
Tickets for Events and Exhibitions
We will retain information for 2 years and process it on the basis of consent and that it is necessary for the purposes of a contract that has been entered into in purchasing tickets from us. We will ensure that a tick box is added to appropriate documents for participants to sign up for emails.
Archives and Collections
If visitors / volunteers make an enquiry about archives or collections, we will ask them for their contact details in order to report back to them. We will keep their details on record until their enquiry has been completed, at which point we will destroy their information. They may ask for their information to be retained by us in relation to an archive or collection and we will agree with them how long the information may be held for that purpose. We will not use their information for any other purposes. We will only process their information with their consent.
Similarly, if they make a deposit, donation or loan, we will ask them for their details and keep these on record for the duration of the deposit, donation or loan and if we need to retain this information as part of our archive, in which case, we will advise them of this. We will not use their information for any other purposes. We will only process their information with their consent.
Outreach
If people want to know more about our community engagement outreach programmes, we will ask them to provide personal details in order to contact them. We will ask them to confirm they are happy for us to send them information about our future events, activities and relevant projects.
We will retain their information for 3 years and process it on the basis of their consent, or that it is necessary in order to provide a service that we have agreed with them. We will contact them roughly every three years to check whether they still wish to be contacted about our outreach programmes. If they do not re-consent to being contacted at that stage we will delete their information from our records.
Surveys/Questionnaires/Evaluation Form
Sometimes we will ask visitors to complete a survey, questionnaire or evaluation form about our services, in order to help us monitor and improve them, or because we are required to provide this information by our funding providers. Unless they opt in to our marketing mailing lists, we will only use their information for the purposes of the survey they have completed.
We retain their information for 3 years and process it on the basis of their consent. After this period we will delete their information from our records.
Photographs, Video or Audio recordings
Sometimes we will ask for permission to take photographs, video or audio recordings of individuals to use as part of our programmes and exhibitions, or to help promote our services. We will always ask for consent before we do this and ask visitors to complete the relevant forms authorising us to proceed.
Invites to events and exhibition previews will include a statement that we will be taking photos so that these can be used for future publications without having to ask for consent / permission each time.
We retain the images and recordings for three years from date of consent. After three years we will either ask them if they are willing to extend their consent for their continued use, or we will delete them. The processing is on the basis of their consent.
Volunteering applicants
Volunteers applying at BMG, we will use the information they supply to process their application and to monitor recruitment statistics. Where we need to disclose information to a third party, for example where we want to take up a reference or obtain a ‘disclosure’ from Disclosure or the Disclosure and Barring Service, we will not do so without first informing them.
Personal information about unsuccessful candidates will be held for 6 months following completion of the recruitment exercise, after which it will be destroyed unless they have asked us to destroy it earlier or they have consented in writing to its longer retention.
Personal information about successful volunteers will be held for the duration of their volunteering and for 6 months afterwards, after which it will be destroyed.
How we use your data from digital / internet access
Cookies
Cookies are text files placed on your computer to collect standard internet log information. This information is used to track visitor use of the website and to compile statistical reports on website activity. For further information visit www.aboutcookies.org or www.allaboutcookies.org. You can set your browser not to accept cookies and the above websites tell you how to remove cookies from your browser.
Other websites
Our website contains links to other websites. This privacy policy only applies to our website so when you link to other websites you should read their own privacy notices.
Internet enabled devices
If your smartphone, tablet or another device is Wi-Fi enabled, it can still be detected by the free Wi-Fi service even if you have not signed into it.
Sharing your data
We may disclose your personal information to third parties. For example, we may pass your personal information to:
- third party organisations that provide services to us (including assisting us with carrying out marketing, online booking, bulk email distribution services, promotional or research activities)
- tutors of workshops you have booked that are run by external organisations or individuals
- external agencies and organisations (including the police and other law enforcement agencies) for the purpose of preventing and detecting fraud (including fraudulent transactions) and criminal activity. We may share non-personal aggregate statistics (group) data about visitors to our website to enable us to improve the way we communicate on our website with you.
Please note we may occasionally need to transfer your personal information overseas, for instance to our bulk email distributor, MailChimp. Where this is necessary, this may be to countries or territories around the world.
How we keep your information secure
Please read our data protection policy.
What choices do you have?
If you think the personal information we hold about you is inaccurate or incorrect, you can request that we correct this information (including your marketing preferences) by contacting us using the details below.
You can choose to stop receiving:
- marketing emails or SMS messages from us by following the unsubscribe link and instructions on the respective marketing emails or SMS messages we send you; and
- telephone calls or postal communications by contacting us using the details below.
You can also choose to change your marketing preferences by writing to us using the details below.
Changes to this policy
This policy is subject to continuous review and improvement and as such is subject to change from time to time. If we make any significant changes to the way we treat your personal information we will make this clear on or website.
Your rights
Whilst we strive at all times to ensure that your personal information is accurate and up to date, we recognise that on occasions we may get it wrong or your details may change. You may ask us to correct or remove your personal information by contacting us as detailed below in the “Contact us” section.
You have the right to:
- request a copy of the personal information we hold about you (you will need to complete a Subject Access Request – details are set out below).
- request that any inaccuracies are corrected
- request us to stop processing your personal data
- lodge a complaint with the Information Commission’s Office.
Contact us
Please do not hesitate to contact us if you have any questions about this policy. Communications should be sent to ask@bailiffgatemuseum.co.uk
If you are submitting a Subject Access Request, please email us on the address above with the heading “Subject Access Request” and provide the following details:
- your full name, address and contact telephone number
- details of the specific information you require and any relevant dates, for example your personal records or CCTV camera situated at X location and date and time.
When we have all the information we need from you we will respond to your query promptly and within the 40-day statutory time limit.