(General Data Protection Regulations 2018)
The Gurkha Museum Trust – Registered Charity No 1169920
Adopted………………11 May 2018….
THE GURKHA MUSEUM TRUST – Registered Charity No 1169920
What information do we collect about you?
We collect information about you when you register with the Museum to use our services, attend our events, make a purchase, join as a Friend, or make a financial donation or donation of an item for the Museum’s collection. We also collect information when you voluntarily complete a survey, provide feedback, and participate in competitions and social media conversations.
Personal information we collect may include:
- Your name, title, gender and date of birth
- Postal and email addresses
- Phone numbers
- Family and spouse/partner details
- Relationships to other donors and/or Museum Trustees
- Current interests and activities
We will also collect and hold information about any contact you have with us as a visitor, customer or Friend of The Gurkha Museum and this may include details of:
- Ticket purchase and event registration/attendance
- Contact preferences
- Online or in store retail purchases
- Gift information, including Direct Debit bank details where applicable
- Gift Aid status
- Details of correspondence sent to you or received from you
- Donor status and wealth assessment information
- Employment information and professional activities
- Selected CCTV and media coverage, where relevant
When we ask you to provide your personal information we will let you know why we are asking, and how we will use your data, and direct you towards this notice for more information.
Information regarding donations to the Museum
We collect information about you when you make a gift to the Museum’s collections, or indicate a future bequest. This information is used to verify the provenance and copyright of the item and to provide an audit of ownership. This information will not normally be made publicly available; consent will be sought from the donor if an occasion arises in which the donor’s name is required to be linked to an item on display.
We also collect information about you relating to any financial support you give the Museum, and this may be shared for processing purposes, eg, with HMRC or your bank.
How will we use the information about you
We collect information about you in order to fulfil our charitable tasks and provide you with the service you have requested. Depending on your relationship with the Museum, and the preferences you have indicated, data we hold may be used by us for the following purposes:
Marketing and communication
If you consent we well send you information about activities and services of the Gurkha Museum that may be of interest to you, by post, telephone or email. If you have consented to receive marketing and later change your mind, you may opt out at a later date by emailing firstname.lastname@example.org or using the contact details below.
Marketing communications may include:
- Details of other products, services or events related to the Museum, such as exhibitions, events or retail offers
- News and updates about the Museum such as our marketing, learning or Friends newsletters
- Details of fundraising operations, including requests to consider giving financial support to Museum projects
- Surveys for market research purposes
- Responses to complaints, legal claims or other issues
There are some Friends’ Membership and donation communications that we are required to send regardless of your contact preferences. These are essential communications, deemed necessary to fulfil our contractual obligations to you. This would include Direct Debit confirmations, thank you and renewal letters, Friends’ benefits, and queries regarding returned mail.
Your information may be used in the following ways:
- Data screening and cleaning to check if we have accurate contact details for you
- Research to help us understand our Members, donors and potential donors
- To claim Gift Aid on your donations
To help us understand our visitors and donors we may combine information that you volunteer to us with information from publicly available resources to build a profile which will enable us to ensure that our communications are relevant to you, and to give us insight into your interest or capacity to support the Museum and in getting involved in our activities. Fundraising research is vital to our development activities to ensure that not only does the Museum continues to thrive for generations to come, but also to ensure that any fundraising requests are appropriate and justified.
Other Reasons for processing
- compliance with legal, regulatory and corporate governance obligations and good practice
- gathering information as part of investigations by regulatory bodies or in connection with legal proceedings or requests
- ensuring business policies are adhered to (such as policies covering security and Internet use)
- operational reasons, such as recording transactions, training and quality control
- ensuring the confidentiality of commercially sensitive information
- security vetting, investigating complaints and allegations of criminal offences
- statistical analysis
- preventing unauthorised access and modifications to systems
- checking references
- ensuring safe working practices, monitoring and managing staff access to systems and facilities and staff absences
- staff and volunteer administration and assessments, monitoring staff conduct, disciplinary matters
- analysing purchasing preferences and improving services
Disclosures and exchange of information
- We may disclose and exchange information within the Museum’s administration, accountancy support agents, as well as with law enforcement agencies and regulatory bodies for the above reasons.
- Information may be held at our offices. Information may be transferred internationally to other countries around the world, including those without data protection laws equivalent to those in the UK, for the reasons described above. We have security measures in place to seek to ensure that there is appropriate security for information we hold.
Children and Vulnerable Adults
We do not knowingly collect personal data relating to children under the age of 16. If you are a parent or guardian of a child under the age of 16 and think that we may have information relating to that child, please contact us at the address below. We will ask you to prove your relationship to the child but if you do so you may (subject to applicable law) request access to and deletion of that child’s personal data.
Extra care and clarity of terminology will be used in explaining the content and effect of the provisions on this Policy when communicating with Children and Vulnerable Adults.
Sensitive personal data
- You may also supply, unsolicited or not by us, sensitive personal data relating to your racial or ethnic origin, political opinions, religious or similar beliefs, trade union membership, physical or mental health, or criminal record which is collected during the following processes: eg job applications, DBS checks, administering our pension scheme, equal opportunities monitoring etc.
- We will usually only collect and record sensitive personal data with your prior consent. However, occasionally we may do so without consent where required or permitted to do so by applicable law eg to comply with diversity reporting requirements and would only disclose that sensitive personal data in accordance with and following a legal requirement to do so.
With whom might we share your information?
We will not sell your details to any third parties, nor disclose personal data to any third parties or external organisations, other than trusted data processors and service providers carrying out work on our behalf. Examples of data processors would be mailing houses, bulk email distribution services, or wealth screening and data cleaning organisations. We do comprehensive checks on any companies working on our behalf before we work with them, and put a contract in place that sets out our expectations and requirements, especially regarding how they manage the personal data they collect or have access to in line with the 1998 Data Protection Act and the new General Data Protection Regulations (2018). We will apply for your explicit and informed consent in the event that we require to share your data in any other way that is not covered in this policy.
Systems used to process data
We gather information directly from you and also via our websites and other technical systems. These may include, for example, our:
- computer networks and connections
- CCTV and access control systems
- communications systems
- remote access systems
- trading platforms
- email and instant messaging systems
- Internet facilities
- telephones, voicemail, mobile phone records
How we keep your information secure
The Gurkha Museum has implemented security procedures rules and policy to protect the personal data under our control from unauthorised access, improper use or disclosure, or unauthorised modification. All employees, volunteers and data processors are obliged to respect the confidentiality of the personal data of our visitors and Friends.
Access to your information and retention
You have the right to request a copy of the information that we hold about you: this is called a Subject Access Request. If you would like a copy of some or all of your information, please email or write to us at the address below.
We fully comply with the terms of the Data Protection Act (1998) and the new General Data Protection Regulations (2018), and will respond to any requests to remove, change or provide any personal details you have given us under the terms of the Act and Regulations, including the right to be forgotten.
Your information will be retained within the Museum’s secure systems for as long as you continue to engage with the Museum’s services and events.
Cookies are text files placed on your computer to collect standard internet log information and visitor behaviour information. This information is used to track visitor use of the website and to compile statistical reports on website activity.
You can set your browser not to accept cookies and the above websites tell you how to remove cookies from your browser. However in a few cases some of our website features may not function as a result.
CCTV and filming/photography by the Museum
CCTV is used extensively throughout the Museum and outside to monitor the activities of individuals. The Museum abides by the CCTV Code of Practice in the management of information recorded and retained by surveillance equipment.
Filming and photography may take place within the Museum during special events and other occasions, and visitors will be notified of this through the use of posters and verbal instructions.
Visitors will be asked to sign a consent form if they are to feature prominently in any recording made, and these consent forms will be retained according to the Museum’s retention schedule in a secure environment.
Right to request a copy of your information
You can request a copy of your information which we hold free of charge (this is known as a subject access request).
We will provide this information without undue delay and in any event within one month of the request, although we may extend the period by two further months where necessary taking in to account the complexity and volume, but we will let you know if this is the case.
Right to correct any mistakes in your information
We are committed to holding complete and accurate personal data. You can require us to correct any mistakes in your information which we hold free of charge.
Right to erasure (“right to be forgotten”)
You have the right to ask us to erase personal data without undue delay in certain circumstances, such as you wish to withdraw consent to us processing it for marketing purposes. However, this does not apply if we are required to comply with a legal obligation or if the processing is necessary for the establishment, exercise or defence of legal claims.
Right to restrict processing
You have the right to block or suppress processing of personal data.
Right to data portability
This right allows you to obtain and reuse your personal data that you have given us by moving, copying or transferring it from one IT environment to another.
Data controllers and how to contact us
The designated Data Controllers for the Gurkha Museum is the Director.
You have a right at any time to stop us from contacting you for marketing or any other purpose.
By post: The Gurkha Museum, Peninsula Barracks, Romsey Road, Winchester, SO23 8TS
By telephone: 01962 842832
By email: email@example.com