Museums privacy notice

About this notice

This privacy notice explains how Northampton Museums collects, uses and protects any personal information that you give to us.

In order to meet our responsibilities as a local authority museums service and provide this service we collect and process a considerable amount of personal information. The personal data you supply is processed in accordance with the General Data Protection Regulations (GDPR) and the Data Protection Act (DPA) 2018.

We are committed to ensuring that your privacy is protected. This privacy notice will tell you who we are and what to expect when Northampton Museums collects your personal information and is intended for visitors, customers, donors and lenders, enquirers, volunteers, suppliers, supporters and anyone who uses the museum service.

Northampton Museums

Northampton Museums consist of Northampton Museum and Art Gallery and Abington Park Museum. We are a local authority museum service governed by Northampton Borough Council. The museum service cares for the largest shoe collection in the world. The collection is designated as being of national and international significance and consists of 12,000 shoes and 50,000 archival records including documentary footage and fine art. The other collections cared for by the museum service include fine art, decorative art, social history, archaeology, geology, ethnography and military.

Who is responsible for your information?

Northampton Borough Council is the data controller for the personal information collected. The current registration number is Z5256045.

For more information about how we manage your personal date please contact the Data Protection Officer.

By email: [email protected] or [email protected]

By telephone: 01604 838536

By post: The Data Protection Officer, Northampton Borough Council, The Guildhall, St Giles Square, Northampton, NN1 1DE

Personal information we may collect

Personal information identifies a living person or can be identified as relating to a living person.

Basic personal information includes, name, address, date of birth, telephone numbers, email contacts and financial account details.

Special category personal information (sensitive personal data) includes racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union member ship, generic or biometric, physical or mental health conditions, sex life or sexual orientation.

Information for parents and guardians of children or young people

We will protect and respect the personal information of individuals, especially those under the age of 13 or younger.

We will not use the personal information of children or young people for marketing purposes or profile purposes.

Personal information about children and young people will only be accessible to museum staff on a strictly need to know basis.

Collecting personal information

We may be required to collect personal information from you in the following ways:

Paper, electronic or online forms, email, telephone, website, personal contact with one of our employees or one of our partners, consultations and surveys, CCTV, Wi-Fi and audio guides.

How we use your personal information

We collect and use your personal information for the museum administration purposes required for potential donations, accepted donations, bequests, purchases, loans, identifications, enquiries, rights management (copyright), insurance and rationalization relating to the museum collections.

If a donation item is transferred to another organisation the accession information including the donors contact details will be passed to that organisation to ensure the provenance and history of the item is maintained.

  • We collect and use your personal information to communicate with you for marketing purposes such as promoting exhibitions and events, shop products, general information, fundraising and other ways you may be able to support the museum service. We will not use your personal information for these purposes if you have opted out, unsubscribed or not given specific consent
  • We collect and use your personal information for commercial bookings and hire and image, media or other licencing for contractual reasons
  • We collect and use your personal information for ordering tickets and goods or services supplied by the museum service
  • We collect and use your personal information for job or freelance recruitment opportunities and management purposes
  • We collect and use your personal information as part of the museum volunteer recruitment and management for administration purposes, emergency contact details and health and safety requirements. We also collect information as a record of individuals who have worked on our collection
  • We collect and use your personal information given to us for future audience development of visitor and customer services analysis. We will not use your personal information for these purposes if you have opted out, unsubscribed or not given specific consent

Who we share your personal information with

We will not sell, distribute or lease your personal information to third parties unless we have your permission or as required by law.

We will share relevant data with external organisations such as transfer of museum items to other organisations, mailing house in order to process mailings, analytical services to enable us to target our communications with customers and supporters and payment processing companies.

We may also disclose personal information where required by law or where necessary for a lawful purpose.

Conditions under which we use your information

We will follow the principles of fair and legal processing according to the General Data Protection Regulation (GDPR). We will only process personal information under the following lawful conditions:

  • You have consented to the use of your personal information for a specific purpose such as marketing
  • We need to process your personal information to deliver a contracted service such as ticket buying
  • We are entitled or required by law to process certain personal information to prevent fraud or crime prevention
  • The need to protect the vital interests of any person
  • We are required to process personal information in the performance of a task carried out in the public interest or the exercise of our official authority, such as management of collections or using CCTV to protect the museum and museum visitors
  • The processing of personal information for legitimate interests that are not covered by previous definitions but enable the museum to meet its legislation objectives. These may include: potential donors, donations, purchases, bequests, loans, insurance, rights management (copyright), marketing, publicity, fundraising, visitor and customer analytics, exercising or defending legal claims and correspondence

Visitor and customer analytics

Visitor analytics information is collected to improve the understanding of the museum target audiences and improve customer service delivery.

Visitor analytics information is usually where possible collected anonymously. This includes monitoring visitor numbers and movement of people and individuals in the museum buildings  

Commercial transactions such as ticket and retail purchases and e-mail and Wi-Fi help develop the marketing more efficiently. You can formally object to this marketing activity and we will automatically unsubscribe you from marketing by contacting the museum service on telephone number 01604 838111 or email [email protected]

Fundraising

Fundraising is a fundamental way for the museum service to generate income. The analysis of personal information collected enables the appropriate contact of individuals and organisations for fundraising purposes. You can object to this use of your personal information for fundraising purposes by contacting the museum service on telephone number 01604 838111 or e-mail [email protected]

Website, cookies and tracking

When you visit the museum website we collect standard internet log information and details of visitor behaviour patterns. We do this to find out the number of visitors to various parts of the website and to compile statistical reports.

Cookies are text files placed onto your computer to collect this information. You can set your browser to not accept cookies and you can remove cookies from your browser.

The museum website contains links to external websites. We are not responsible for the content of these websites. If a third party website requests your personal information then the information you provide will not be covered by the Northampton Museums privacy policy. You should read the privacy notice of any other website you are using before providing personal information.

Wi-Fi service, CCTV and audio guides

We operate a Wi-Fi system at Northampton Museum and Art Gallery and Abington Park Museum, counting systems and sensing systems to detect movement within the museum buildings.

Free Wi-Fi access is available at these museum sites. If you access this network you will be asked to agree to the museums service Wi-Fi terms and conditions which will explain how your information will be used.

Your image may be captured by the museum CCTV system during a visit. The system is managed according to operating procedures and good practice guidance by museum staff and are stored for 30 days unless required for review.

The use of museum audio guides may require proof of identity information.  

Transfer of your data abroad

There are no current circumstances where Northampton Museums and Art Gallery will transfer your data outside the EU.

If ever necessary we will always ensure an adequate level of protection is provided for any personal information transferred outside of the European Economic Area as required by the General Data Protection Regulation (GDPR).

Data security

  • Museum staff receive personal data training and follow a set of data protection procedures required for handling personal information
  • Museum staff must use appropriate levels of security to store or share personal information
  • Paper records of personal information are secured physically for storage and access protection
  • Electronic personal information and databases are held on a secure computer network controlled by authorised username and password protection. Passwords must not be shared and personal information not held on the computer network must be encrypted
  • Data Privacy Impact Assessments (DPIA’s) will be produced by the project manager and reviewed by the DPO for any new projects involving personal information
  • Any suspected breach of security, data loss or cyber-attack will be investigated by the Data Protection Officer (DPO) who will manage the actions necessary and report the incident
  • Any suspected breaches of data must be reported by museum staff to the DPO
  • A personal data asset register and personal data process maps will be maintained by the DPO identifying all personal data held, where it is held, security measures used to restrict access, how the data is processed, what teams or individuals have access to data, who has overall responsibility for the data

How long we keep your information

We will only keep your personal information for as long as required for the purpose it was collected. We will continually review the personal information we hold and delete when no longer required.

Your rights under the General Data Protection Regulation (GDPR)

  • Access to and copies of the personal information that we hold about you
  • If you require the correction of any inaccurate personal information we hold about you
  • The requirement to restrict the use of your personal information
  • An objection to the use of your personal information
  • An objection to receiving marketing communications from us
  • Withdrawal of your consent to the use of your personal information
  • If you require us to erase your personal information (right to be forgotten)
  • Obtain from us your personal information you have provided in order to transmit to another organisation (data portability)

The above rights are not absolute and requests can be refused where exceptions apply. How your rights are fully dealt with are set out elsewhere in this privacy notice. You do have the right to refer any concerns or queries to the supervisory authority, the Information Commissioner’s Office.

Your access to personal information and correction

The museums service will strive to ensure your personal information is accurate and up to date. You can ask for your personal information to be corrected or remove information you believe to be incorrect by contacting us on telephone number 01604 838111 or email [email protected]

Please contact us if your personal details change to help us keep your information up to date.

Your consent and right to opt out

If we intend to use your personal information for certain types of marketing or where your specific consent is required then we will ask for your specific consent to use this information.

When we ask for this personal information we will explain how we intend to use the information and consent will require a signed form to subscribe. Subscribing to marketing communications or is optional. You will be able to unsubscribe at any time by contacting us on telephone number 01604 838111 or email [email protected]

Your complaints, enquiries and feedback

We will meet the high standards required when collecting, storing and using personal information. Complaints, enquiries and feedback will be taken seriously. Please bring to our attention any collection, storage or use of personal information you believe is unfair, misleading or inappropriate.

If you have any complaint, enquiry or feedback about data protection please contact the Data Protection Officer:

By email: [email protected] or [email protected]
By telephone: 01604 838536
By post: The Data Protection Officer, Northampton Borough Council, The Guildhall, St Giles Square, Northampton, NN1 1DE

Changes to this privacy notice

We will review this privacy policy to ensure it remains relevant. The current version of our privacy notice will always be on our museum website. Please check this page regularly to keep up to date with any changes.

This privacy notice will be reviewed no later than 2021.