- Who are we and what services do we provide?
-
Chertsey Museum is the borough museum for Runnymede, displaying a wide range of items from archaeology, art and social history, documents and textiles. It also provides learning programmes, events and activities for the local community.
- What personal information do we collect?
-
We collect the following information to inform people of activities and events
- Identity data [name, address and contact details]
- Communication preferences [for communication and marketing from us and our third-party partners]
In addition to the above we also collect and process the following information to run activities and events.
- Booking information [Identity data of the person making the booking, number of individuals in the booking, dates, times and prices]
- Payment information [card details and transactional data including payment history]
- Attendee information [name, date of birth, gender and attendance at our activities and events]
- Medical information [medical, learning, emotional and behavioural special needs that apply to the event or activity they are attending]
We require the following information to record objects gifted or provided to the Museum.
- Donor information [name, address, contact details, ownership details]
- History of the object [its connection to the past and present]
We require the following information to sell copies of photographs of the museum collections and ensure copyright restrictions are enforced.
- Identity data [name, address and contact details]
- Payment information [card details and transactional data including payment history]
Cookies taken from the Chertsey Museum website is used to follow your actions from page to page, to track which web server to send you to, improve the performance of our website and analytic tracking.
We collect this information in a variety of ways. For example, data is collected through application forms and correspondence with you about the following services
- Events and activities
- Museum collections
- School bookings
- What lawful basis is engaged?
-
Our lawful basis for the above purposes is as follows
- Contract - We need to process data for the performance of a contract with you. For example, we need to process your data to provide you with the services referred to, or in order to take steps at your request, prior to entering into a contract for these services. All of your data protection rights may apply, except the right to object.
- Legal obligation - In some cases, we need to process data to ensure that we are complying with our legal obligations. For example, we have a duty to report safeguarding issues to the appropriate authority. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.
- Legitimate interest - Processing personal data to provide the public with a historical record of local history. For example, we need to provide information in connection with the items on display at the museum. When considering what information should be used for this purpose, we take into account the privacy impact on those individuals. Where consent is not possible, we ensure an appropriate time period has elapsed before disclosing the information to the wider public. All of your data protection rights may apply, except the right to data portability.
- Consent - Where we believe we have other services or events which may be of interest to you, we would like to notify you of this. However, we will always ask for your consent and give you the opportunity to withdraw consent at any time. All your data protection rights apply.
- Why do we process personal data?
-
We need to process data for the performance of a contract with you. For example, we need to process your data to provide you with the services referred to, or in order to take steps at your request, prior to entering into a contract for these services. In some cases, we need to process data to ensure that we are complying with our legal obligations. For example, we have a duty to report safeguarding issues to the appropriate authority. In other cases, we have a legitimate interest in processing personal data to provide the public with a historical record of local history. For example, we need to provide information in connection with the items on display at the museum. When considering what information should be used for this purpose, we take into account the privacy impact on those individuals. Where consent is not possible, we ensure an appropriate time period has elapsed before disclosing the information to the wider public. Where we believe we have other services or events which may be of interest to you, we would like to notify you of this. However, we will always ask for your consent and give you the opportunity to withdraw consent at any time.
- Who has access to your personal data?
-
Our processors use your data to provide us with services necessary to meet our objectives. We ensure that there are appropriate agreements in place to protect your data and it is only processed under our instruction.
PayPal - Online payment service
- Who do we share data with?
-
Where necessary, for the purposes stated, your information will be shared with following organisations
- Surrey County Council (including Social Services)
- Emergency services (including Police)
- Other Runnymede Borough Council departments
- Other museums
We ensure that all sharing is lawful and appropriately documented. We will not share the information for a reason that is incompatible with the purpose your information was collected, unless there is a legal requirement to do so, an exemption applies, or we have been given consent.
- How do we protect personal data?
-
Please see the ‘How we take care of your personal data’ section of our main Privacy Policy page.
- How long do we keep your personal data?
-
As our events are often annual, we may retain this information for a maximum of 2 years, after which time personal data will be deleted/destroyed unless there is a legal obligation to keep it longer. Or should you renew your consent for marketing information for a further 1-2 years.
Object entry forms will be kept indefinitely to prove provenance and ownership of objects.
Child protection concerns or accidents involving children will be held until three years after their 18th birthday. School booking information will be kept for 5 years after the event or activity, however personal data will be removed after the event or activity has taken place.
- Your rights
-
Rights available are directly related to our lawful basis for processing which is set out above. To find out more about your rights please see the ‘Your Rights’ section of our main Privacy Policy.