This privacy notice sets out how we gather, store and use, any personal information that we collect from you. It is produced in compliance with the General Data Protection Regulations (GDPR) and the Data Protection Act 2018. The GDPR states that personal data can only be processed if there is a legal ground to do so. The GDPR provides six legal grounds under which personal information can be processed lawfully and stipulates that an organisation’s privacy notice must include reference to this. Information about the legal bases for processing of personal information by Woodbridge Tide Mill Museum is set out in the Appendix to this notice.
Who we are
Woodbridge Tide Mill Museum (WTMM) is a small independent museum located at the historic Mill Quay on the River Deben in Woodbridge, Suffolk. As well as functioning as a productive flour mill, the museum presents a permanent display illustrating the social, industrial and economic history of the Mill, Woodbridge, and the surrounding area.
What Information we collect
We collect Personal data that can be used to identify you such as your name, postal address, email address and phone number.
The information that we collect is generally limited to the above contact details. In the case of Friends of the Tide Mill, donors (of charitable gifts and objects) to the museum, volunteers, employees, trustees and service providers, we may also collect information on titles, gender, and employment/volunteering status.
We do not collect any sensitive data (e.g. data about disability, health, offending history).
How we use your Information
We collect information for various purposes as outlined below:
Tickets for Events and Exhibitions
We retain information for 2 years and process it on the basis of consent, and that it is necessary for the purposes of a contract entered into in order to purchase tickets. After this period the information is deleted from our records.
Archives and Collections
When we receive an enquiry about our Collections or Archive, we collect contact details in order to report back. We keep details on record until the enquiry has been completed, at which point we destroy the information. Upon request, and subject to agreement on how long the information will be held, we may retain information in relation to a Collection or Archive. We will not use your information for any other purposes. We will only process your information with your consent.
Similarly, when we receive a deposit, donation or loan, we will collect contact details and keep these on record for the duration of the deposit, donation or loan, at which point we will destroy your information unless it is necessary to retain this information as part of our archive, in which case, we will advise you of this. We will not use your information for any other purposes. We will only process your information with your consent.
When we receive enquiries about one of our learning programmes, courses, activities or services, either from an individual or on behalf of a school or educational establishment, we collect personal information to allow us to provide the relevant information you will need. We retain information for the duration of the school academic year and process it on the basis of consent, or that it is necessary in order to provide an agreed service. At the end of each school academic year we delete the information from our records.
When we receive enquiries/bookings for our community engagement outreach programmes, we collect personal details in order to contact you. We will ask for permission for us to send information about our future events, activities and relevant projects. We retain information for 3 years and process it on the basis of consent, or that it is necessary in order to provide an agreed service. Every three years we check whether individuals still wish to be contacted about our outreach programmes. Without re-consent, we will delete the information from our records.
From time to time we may ask for information about our services via surveys, questionnaires or evaluation forms. We use this data to help us monitor and improve our services, or because we are required to provide this information by our funding providers. We retain this information for 3 years and process it on the basis of consent. After 3 years we will delete the information from our records.
Photographs, Video or Audio recordings
Sometimes we will ask for permission to take photographs, video or audio recordings of individuals to use as part of our programmes and exhibitions, or to help promote our services. We will always ask for consent before we do this and ask for relevant forms to be completed, authorising us to proceed.
We retain images and recordings for 3 years from date of consent. After three years we will either ask if individuals are willing to extend consent for their continued use, or we will delete them. The processing is on the basis of consent.
Inside the museum are a small number of CCTV cameras. These are positioned to allow visitors to view areas of the museum that they may be unable to access physically for a variety of reasons. The video images can only be viewed in real time by staff and visitors to the museum. No recordings are kept of any of the images, they are not used for security purposes, and cannot be viewed by a third party, either in real time or at a later date.
Information collected from volunteer applicants to WTMM, will be used to process your application and to monitor recruitment statistics. Where we need to disclose information to a third party, for example where we want to take up a reference, we will not do so without consent.
Personal information about unsuccessful candidates will be held for 6 months following completion of the recruitment exercise, after which it will be destroyed unless we have been asked to destroy it earlier or we have received consent in writing for extended retention.
Personal information about successful volunteer applicants will be held for the duration of their volunteering and for 6 months afterwards, after which it will be destroyed.
How we use your Information from Digital/Internet Access
The following cookies are used on the WTMM website:
|Google Analytics||Cookies used to collect information about how visitors use the site. This information is used to improve visitor’s experience.|
|TripAdvisor||Used for viewing embedded content from TripAdvisor, including payment of referral commission fees and user tracking across websites.|
Third Party Organisations
We do not share personal data with third party organisations for marketing purposes.
Access to personal information and correction
Whilst we always strive to ensure that personal information is accurate and up to date, we recognise that on occasions we may get it wrong or details may change. Individuals may ask us to correct or remove their personal information by contacting us as detailed below in the “How to Contact Us” section.
A copy of all information that we hold about an individual can be requested in writing as set out in the “How to Contact Us” section below.
You may opt out from receiving marketing communications from us at any time, change your contact preferences or ask to have your personal data removed or corrected in our records by using the contact details below. Please ensure that you state your full name and address in the letter or email so that we may locate your record on our database.
Complaints, enquiries and feedback
WTMM tries to meet the highest standards when collecting and using personal information. We will not unduly prioritise our interests as an organisation over the interests of individuals. We will always aim to balance our interests with an individual’s rights. We will only use personal information in a way and for a purpose that is in accordance with this notice.
For these reasons, we take any complaints we receive very seriously. We ask for notification of any collection or use of your information that is considered unfair, misleading or inappropriate by contacting us at the address in the “How to Contact Us” section below.
This privacy notice was drafted with brevity and clarity in mind. We will provide further detail at the point we collect any personal information, if requested, and we are happy to provide any additional information or explanation if needed.
How to contact us
Enquiries, suggestions or complaints regarding any issues related to this privacy notice, and the way we use personal data, should be directed to firstname.lastname@example.org or in writing at the following address: Woodbridge Tide Mill, Tide Mill Way, Woodbridge IP12 1BYY
Information Commissioner’s Office
The Information Commissioner’s Office (ICO) is the UK’s independent body set up to uphold information rights. Complaints to the ICO about our use of information can be made at any time on 0303 123 1113 or via their website at https://ico.org.uk/. Of course, we’d like to try and help with any problems first, so please consider raising any issue or complaint with WTMM first. Your satisfaction with our services is very important to us and we will always strive to resolve any problems or complaints wherever possible. You can contact us at the addresses shown in “How to Contact Us” above.
Changes to this Privacy Notice
We keep our privacy notice under regular review. Please visit this page periodically in order to keep up to date with any changes. By continuing to access and use our services you will be deemed to have accepted such changes. This privacy notice was last updated on 1st March 2019.
Appendix – WTMM Lawful Bases for Processing Data
The lawful bases for processing personal data are set out in Article 6 of the GDPR. At least one of these must apply whenever personal data is processed:
- Consent: the individual has given clear consent for their personal data to be processed for a specific purpose.
- Contract: the processing is necessary for a contract entered into with an individual, or because specific steps have been requested before entering into a contract.
- Legal obligation: the processing is necessary to comply with the law (not including contractual obligations).
- Vital interests: the processing is necessary to protect someone’s life.
- Public task: the processing is necessary in order to perform a task in the public interest or for an official function, and the task or function has a clear basis in law.
- Legitimate interests: the processing is necessary for legitimate interests of the organisation or the legitimate interests of a third party unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests. (This cannot apply if you are a public authority processing data to perform your official tasks.)
|Area of Organisation||Data Source||Type of data Collected||Lawful Basis for Processing|
|Tickets for Events and Exhibitions||Website||Name, address, email, contact preference, disability and access information||b|
|Archives and Collections||Loans/Deposits||Name, address, contact details||b|
|Archives and Collections||Enquiries||Name, address, email; occasionally personal info relating to enquiry||a|
|Archives and Collections||Items in Collections||Potentially covers all types of personal data. The GDPR permits “the processing of personal data (including sensitive personal data) without consent, where necessary for archiving purposes in the public interest”, subject to appropriate safeguards.||e|
|Learning||School Mailing List||Name of school contact and email address||a|
|Outreach||Contacts for Participants||Name, address, contact details||a|
|Surveys/Questionnaires||Various; online, face to face, paper based||Varies according to survey but can cover Name, address, email, contact details, disability and access information||a|
|Photos/Video/Audio||Standard Forms||Name, email, phone number||a|
|Friends of WTMM||Newsletters||Full name, email||a|
|Governance||Grant Applications||Full name, phone number, email address, job title and organisation (if applicable)||b|
|Volunteers||Volunteer Contracts||Full name, phone number, email address, access requirements||b|