Privacy Policy
Tenby Museum & Art Gallery
Data protection Policy and Privacy Notice
Who Are We:
Tenby Museum & Art Gallery
Castle Hill
Tenby
Pembrokeshire
SA70 7BP
We are a registered charity, our charity number is 1169435
We are registered with the Information Commissioner’s Office and our registration reference is ZA197533.
Any electronic communications will be made in accordance with the Privacy and Electronic Communications Regulation 2003 (PECR).
What information do we collect about you?
We collect the personal data that you may volunteer as part of ticket bookings for events, online purchases, Friends Membership forms, Gift Aid forms, newsletter sign-ups, art invitation sign-ups, event sign-ups, donations to the museum and visitor surveys.
Personal information we collect may include:
• your name, title, gender and date of birth;
• postal address, email address and telephone number;
• family and spouse/partner details
We will also collect and hold information about any contact you have with us as a visitor, customer or supporter of Tenby Museum and Art Gallery, and may consist of details of:
• ticket purchase and event registration/attendance;
• online retail purchases;
• contact preferences;
• gift information, including Direct Debit bank details where applicable;
• Gift Aid status;
• details of correspondence sent to you, or received from you;
• employment information and professional activities;
• where relevant, selected media coverage;
• any other information provided by yourself at the request of Tenby Museum and Art Gallery.
When we ask you to provide your personal information we will let you know why we are asking, and how we will use your data, by directing you towards this notice.
What do we do with your information
Depending on your relationship with Tenby Museum and Art Gallery, and the preferences you have indicated, data we hold may be used by us for the following purposes:
• Send you promotional, marketing or fundraising information by post, telephone or electronic means. This could include information about exhibitions, events and talks, and the Friends and Museum newsletters (four per year)
• Send you surveys for market research purposes
You can opt out of any/all of our communications at any point simply by contacting the museum: info@tenbymuseum.org.uk
There are some Friends of Tenby Museum Membership communications that we are required to send to you. These are essential communications including Direct Debit confirmations, Membership cards and renewal reminders.
Who we might share your information with
Neither the trustees of Tenby Museum and Art Gallery or the Friends of Tenby Museum and Art Gallery will disclose personal data to any third party or external organization.
We may occasionally need to transfer your personal information overseas, for instance to our bulk email distributor, MailChimp. Where this is necessary, this may be to countries or territories around the world.
We will ensure that any transfers of data will be done securely, in accordance with best practice.
How to keep your information secure
All details provided to the museum are retained in a locked safe. No details are ever shared with a third party and you can request details to be removed at any point (unless it is for Gift Aid or object donation, which have to be retained). Details on written forms will be added to the relevant databases and the hard copy shredded immediately.
Databases (such as event and exhibition invitation lists) are stored on the museum’s computer which are password protected. Access is limited to those who need it. Databases are backed up and these back ups are stored in a locked safe. Data privacy on the password protected icloud, in accordance with Apple’s Privacy Policy, will ensure what is stored on the cloud will only be information we have received consent to have.
Consent will be sought and continue to be sought for our existing and new databases.
How can I access the information about me, and correction of information?
You can ask us if we are keeping any personal data about you and you can also request to receive a copy of that personal data. This is called a Subject Access Request.
To make a Subject Access Request you will need to provide adequate proof of identity such as a copy of your passport, birth certificate or driving licence before your request can be processed. There may be a fee of up to £10 depending on the volume of work required. Please try to be as clear as possible about the information you are seeking. Once we have received your Subject Access Request, the agreed fee and proof of identity, you will receive a response from us within 40 days and you will be able to get copies of any information we gold on you. However, exemptions to disclosure may apply in some circumstances.
Subject Access Requests should be sent to:
The Chairman of Trustees
Tenby Museum & Art Gallery
Castle Hill
Tenby
Pembrokeshire
SA70 7BP
At any time you may request that we delete or correct your personal information. If you wish to correct any information on you held by Tenby Museum and Art Gallery, please contact info@tenbymuseum.org.uk
Cookies
In order to make Tenby Museum and Art Gallery’s website easier to use and improve our service, we sometimes place small amounts of information on your computer. These are known as cookies and they are used by the majority of websites. To find out more about Tenby Museum and Art Gallery’s use of cookies, please visit here:
http://www.tenbymuseum.org.uk/cookies-in-use-on-this-site/
Other websites
The website also includes links to relevant content such as Support Us and Blogs. This privacy notice applies to these pages.
Pages on the Tenby Museum and Art Gallery website include links to other relevant sites and organizations. The links are found here:
http://www.tenbymuseum.org.uk/links/
This privacy notice does not apply to these external links or websites. These websites will have different privacy, trading and use policies and conditions.
Changes to our privacy notice
We will regularly review our privacy notice and make changes where necessary. Any changes made will be posted to this page and apply from the time we post them. This privacy notice was created on 11 April 2018.
CCTV
Under the UK-GDPR identifiable imagery is considered as personal data, whether images are captured for security, monitoring or health and safety purposes.
The use of CCTV within the museum will be communicated via signage which indicates the areas covered.
Footage will not be retained for an indefinite period. Screens showing live footage will only be viewed by authorized personnel.
Financial data
Tenby Museum and Art Gallery endeavours to protect your privacy. Credit card payments provide details of payment card numbers and expiry dates but these go through a secure server operated by the museum’s Payment Service provider and to which Tenby Museum does not have direct access. Where direct access is provided (for example with over the telephone sales), personal information required for the transaction is shredded at the end of each day.
Gift Aid
Gift Aid returns are retained for a period of six years for audit purposes and in compliance with HMRC regulations. To comply with HMRC’s legal obligations, the trustees of Tenby Museum and Art Gallery can refuse to delete donor records that relate to Gift Aid. We will ensure however that any personal details are retained in the strictest of confidence and will not be shared to any third party beyond HMRC. The donor giving gift aid details relates to consent under the guidelines of UK-GDPR.
Job and volunteering applicants
If you apply to work or volunteer at Tenby Museum and Art Gallery including Trusteeship) we will use the information you have provided to process your application. Where we need to disclose information to a third party, for example where we need to take up a reference or obtain ‘disclosure’ from DSB, we will not do so without informing you beforehand unless the disclosure is required or otherwise permitted by law.
Personal information about unsuccessful candidates will be held for a period of six weeks after the recruitment exercise. These will be securely housed and unavailable to unauthorized personnel. These records are retained as reference in case a voluntary position comes up. If you wish us to destroy it before hand or allow us to retain it for longer via written permission, then please inform us.
Once you have taken up employment or a volunteer position at the museum, we will compile a file relating to your employment. This information will be kept secure and used for purposes relevant only to your position. Once your position with the Museum has ended we will retain the file for a period of six weeks.
No information provided will be shared with any third party and will be retained in the strictest confidence in a locked safe at the museum.
Newsletters and Events
The museum on average produces up to four newsletters each year. Under legitimate interest, anyone who has opted in to receive such mailings will be kept informed. However there is the opportunity to opt out at any stage. Any opt out information will be updated immediately.
Under the Privacy and Electronic Communications Regulations (PECR) information may be sent directly that is relevant to the original communication without opt in consent. For example, if someone buys and event ticket and provides an email address for the processing, then we can send further information about other similar events. However the email details will not be added to a general database and the opportunity to opt out will always be available in each email.
Consent will be given via the museum’s consent form, along with details of this privacy notice. Under UK-GDPR consent for all forms of data processing and communication will be on an opt in basis to ensure consent is given freely and is specific, informed and unambiguous.
The Data Protection Policy and Privacy Policy will be available on the museum’s website.