Museum of Barnstaple and North Devon

How personal data is used by the Museum of Barnstaple and North Devon

Who we are:

The Museum of Barnstaple and North Devon is managed and owned by North Devon District Council

What personal data do we collect?

Personal information is collected directly from you when you interact with us and allow us to do so, for example:

  • When you register with the Museum to use our services
  • Attend our events
  • Make a purchase from our shop
  • Join as a supporter or make a financial donation (see https://barnstaplemuseum.org.uk/get-involved/)
  • Make a donation of an item for the Museum’s collection
  • Sending or receiving an email
  • Make an enquiry
  • Apply to volunteer with us
  • Hire a space for a corporate or private event
  • Participate in a registered event
  • When signing up to a campaign
  • When you sign up to our newsletter
  • When you voluntarily complete a survey or attend a consultation event
  • When you provide feedback
  • Where you participate in competitions and social media conversations

Personal information may be collected in person, over the phone, through our website, social media or from something you’ve posted to us.

We also collect information when you allow others to share it with us via third parties, for example:

  • Company contacts
  • Organisations processing data on our behalf, eg Direct Debits
  • Third party fundraising sites, eg Just Giving, Virgin Money
  • Third party crowdfunding sites, eg Art Fund, CrowdFunder

Personal information we collect may include:

  • Your name, including your title
  • Date of birth, only where needed for age related products
  • Postal and email addresses
  • Phone numbers
  • Bank Details (where relevant to making a purchase or donation)
  • Your profession where appropriate
  • Your age, ethnicity, disability and family status where appropriate (for instance in making reasonable adjustments for volunteers or equal opportunities monitoring conducted on an anonymous basis)

We will also collect and hold information about any contact you have with us as a visitor, customer or supporter of the Museum of Barnstaple and North Devon, and this may include details of:

  • Ticket purchase and event registration/attendance
  • In store retail or café purchases
  • Gift information, including Direct Debit bank details where applicable
  • Gift Aid status
  • Details of correspondence sent to you or received from you
  • Donor status and wealth assessment information
  • Employment information and professional activities
  • Selected media coverage, where relevant

Information collected regarding donations or loans to museum collections

We collect information about you when you make a gift to the Museum’s collections, where you loan an item to the Museum's collections or you indicate a future bequest. This information is used to verify the provenance and copyright of the item and to provide an audit of ownership. This information will not normally be made publicly available; consent will be sought from the donor if an occasion arises in which the donor’s name is required to be linked to an item on display.  Consent can be withdrawn at any time by contacting the Museum's staff using museum@northdevon.gov.uk.  On occasion your information may get passed onto the Portable Antiques Scheme for recording the object or or where your find has to be recorded to comply with the Treasure Act 1996 (for more information about how the Portable Antiques Scheme processes your data please see https://finds.org.uk/info/privacy).

We also collect information about you relating to any financial support you give the Museum, and this may be shared for processing purposes, eg. with HMRC or your bank.

 Some of these identifications may get passed on to the Portable antiques scheme for the recording of the object or for treasure

Purpose and lawful basis for processing

We follow the principles of fair and legal processing described in the General Data Protection Regulation (GDPR). We will only process personal data under one of the available lawful conditions (legal bases), if:

  • pursuant to Article 6(1)(a) GDPR you have consented to the use of your personal data for the specific purpose in question, such as for receipt of our newsletter or where we intend to link you to an item we are displaying
  • where, pursuant to Article 6(1)(b) GDPR, we need to process your personal data in order to deliver a contracted service, such as when you buy a ticket for an event or purchase an item
  • where, pursuant to Article 6(1)(c) GDPR, we are entitled or required by law to process personal data in a certain way, such as in compliance with the Treasure Act 1996, for fraud or crime prevention
  • where, pursuant to Article 6(1)(e) we are required to process personal data in performance of a task carried out in the public interest or in the exercise of our official authority as part of North Devon District Council (pursuant to section 12 of the Public Libraries and Museums Act 1964), such as in the management of the collections
  • where, pursuant to Article 6(1)(f) the processing of personal data is within our legitimate interests, where we carry out activities such as (a) marketing, publicity and fundraising mailshots that do not require consent (eg postal or phone contact from Development and Communications staff or business to business communications), (b) prospect research prior to first contact, (c) due diligence research on potential donors, (d) visitor and customer analytics, (e) exercising or defending legal claim or (f) correspondence

Where we collect or process special category data, such as information about health, race or criminal offence information, the lawful basis we rely on to process it is article 9(2)(g) of the GDPR. This also relates to our public task and the safeguarding of your fundamental rights. And Schedule 1 part 2(6) of the Data Protection Act 2018 which relates to statutory and government purposes.  In the provision of our museum service we may also rely on the lawful basis in article 9(2)(j) that processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes.

Volunteers

If you’re a volunteer we may collect extra information about you (such as references, criminal records checks, details of emergency contacts or medical conditions). We will keep this information for legal or contractual reasons, to protect us (including in the event of an insurance or legal claim), and for safeguarding purposes.

We need to use your personal data to manage your volunteering, from the moment you enquire to the time you decide to stop volunteering with us.

This could include:

  • contacting you about a role you’ve applied for or which we think you might be interested in
  • processing expense claims you’ve made
  • recording shifts you’ve booked
  • recognising your contribution
  • asking for your opinions on your volunteering experience
  • next of kin details

How long we keep it

For information about how long we hold personal data, see our Retention Schedule.

What are your rights?

As set out above ,we are acting pursuant to our public task in providing a museum on behalf of the Council and we occasionally use your consent and pursuant to legitimate interests of the Council. You therefore have the right to object to our processing of your personal data. There are legitimate reasons why we may refuse your objection (save where you are withdrawing your consent), which depend on why we are processing it. For more information on your rights see Your Rights.