This page sets out the details of Ripon Museum Trust’s privacy notice in relation to information collected about you.
Who we are
Ripon Museum Trust, Workhouse Museum , Allhallowgate , Ripon , HG4 1LE
We are registered as a Charity, and our registration number is: 1141462
We are a registered company and our company registration number is: 7465640
We are registered as a data controller under the Data Protection Act 1998, and our Data Protection Register number is: Z3090431
Any electronic communications will be made in accordance with the Privacy and Electronic Communications Regulations (PECR)
What information do we collect about you?
We collect the personal data that you may choose to give us in one of the following ways: online or paper based ticket bookings, donation forms, e-newsletter sign-ups and visitor surveys.
Personal information we collect may include:
your name, title, gender and age/date of birth;
postal address, email address and phone number;
Ethnicity and whether your day to day activities are limited by disability
We collect additional information if you choose to join us as a member. This additional information can include:
Bank account details for processing membership
When we ask you to provide your personal information we will let you know why we are asking, and how we will use your data, by directing you towards this notice.
What we do with your information
How we use the information depends on the reason you gave us the information on the first place:
Mailing list – If you sign up to our mailing list, we will send you marketing information about upcoming events, activities, programmes and opportunities to support and engage with the Ripon Museum Trust.
Event or ticket purchases – We only use the data you provide to contact you about the event/ticket you purchased. This includes confirmation of booking/payment, updating you on any information that changes, letting you know if it is cancelled or sending additional promotional or factual information about the event/ticket. Following the Coronavirus outbreak, Ripon Museum Trust is assisting the NHS Test and Trace. To do this, we are retaining a temporary record of ticket bookings for 21 days. If you do not want your details shared for the purposes of NHS Test and Trace, you can choose to opt out, and if you do so we will not share the information used for booking purposes with NHS Test and Trace.
Visitor surveys – Your data is collected to be entered into the Audience Agency’s Audience Finder system. This allows up to gather sample data about our audience. We use this aggregated set to monitor our audience and report to funders. Once an individual survey is entered it becomes part of the set and we destroy the original data (if in paper based form). We do not use data on individuals, only the aggregated results from all surveys.
Donation forms – If you make a donation, we’ll use any personal information you give us to record the nature and amount of your gift, claim Gift Aid where you’ve told us you’re eligible, thank you for your gift .
Photography Permission Forms – If you allow us to take a photo of you at an event, we will ask you to fill in a permission form stating which channels we may use the photo for. We hold this information for the purpose of proving consent was given if there is an issue that arises and so we could find and remove those photos from our system if you change your mind and withdraw permission for them to be used.
Volunteers or members – We use your information to contact you about your volunteering and/or membership of the Trust. We will send you information which we feel is relevant, useful or contractually required about your engagement with the Trust. This can include updates on our work including campaigns we are running, fundraising we are undertaking or new events we are conducting, though this is for information only and not as a request for support. We would also send changes to policies and procedures, reminders for payment or your annual membership card. We would not send you marketing information unless you specifically join the mailing list as detailed above.
You can opt out of any / all of our communications at any point simply by contacting [email protected].
There are some Membership and volunteering communications that we are required to send regardless of your contact preferences. These are essential communications, deemed necessary to fulfil our contractual obligations to you. This would include Direct Debit confirmations and advanced notices, thank you letters, Member benefits such as your annual pass and Ripon Historian magazine, renewal reminders, Gift Aid confirmation letters and querying returned mail or bounced Direct Debit payments with you.
How long will we hold your information for
The length of time depends on the purpose we hold your information for:
You are a member of the Trust – For the duration of your membership plus 1 year after it expires – Members are liable for the company for up to 1 year after their membership expires
You a volunteer with the Trust – For the duration of your volunteering plus 3 years after you stop – To enable us to answer any reference requests or to contact you if a critical issue arises (e.g. complaint or legal action) which we need your input for
You are on our mailing list – Indefinitely until you unsubscribe – Mailing list is opt in to commence and you can receive it for as long as you feel you would like to receive it
You filled in a survey – Until they survey data has been entered onto the Audience Finder system – Once entered, the data is added to the collected data and becomes anonymised
You gave us permission to use a photo – For a maximum of 5 years – We may use photos for up to 5 years, we will then withdraw them from use on our promotional channels.
You completed a gift aid form to give us a donation – For 7 years following the donation – This is the legally required amount of time we have to hold financial records for
You donated an item for our collection – Indefinitely until we deaccession the item – We are required to show evidence of ownership of all the items in our collection. Should we also choose to deaccession (remove) an item from our collection, we are required to make every attempt to return it to the donor as a first step.
You bought tickets to the museum or an event – Until after the event has occurred – Our need to be able to contact you about the event will cease after the event – 21 days to assist with NHS Test and Trace
You have corresponded with the Trust via email or letter – 2 years from the date of receipt – We may need to refer to your correspondence, especially if it about a long term project
You appeared in one of our educational films – the recording may be retained by the RMT as long as is necessary for education and research purposes – This enables us to maintain our learning programme
When the time limit for holding a piece of data expires, we will either delete it from our digital systems or shred it if it is in hard copy. All such actions will take place at the end of each quarter (March, June, September and December) so we may end up holding your data for a maximum of 12 weeks until the regularly scheduled removal. This is to ensure all data is processed in an organised fashion by our small staff team and that time commitment is kept to a reasonable level.
Legal basis for processing your information
Our legal basis for collecting and using the personal information described above will depend on the personal information concerned and the specific context in which we collect it.
However, we will normally collect personal information from you only (i) where we have your consent to do so, (ii) where we need the personal information to perform a contract with you, or (iii) where we are obliged to process the information in order to comply with our legal and statutory requirements.
If we ask you to provide personal information to comply with a legal requirement or in order to meet our membership or Gift Aid requirements we will make this clear at the relevant time and advise you whether the provision of your personal information is mandatory or not.
Who we might share your information with
We do not disclose personal data to any third parties or external organisations, other than data processors carrying out work on our behalf, or where we are legally required to do so.
Any such companies are acting as approved data processors for Ripon Museum Trust, and we retain full responsibility for your personal data. Data processors will act only on our instructions.
We may occasionally need to transfer your personal information overseas, for instance to our bulk email distributor, MailChimp. Where this is necessary, this may be to countries or territories around the world.
We are required to ensure any transfers of data will be done securely, in accordance with best practice, and in compliance with the Data Protection Act 1998.
Your data will never be sold or passed to any third party for any other purpose.
How we keep your information secure
Ripon Museum Trust take every reasonable precaution to prevent loss, misuse or alteration of information you give us. However, whilst we endeavour to keep our systems and communications protected against viruses and other harmful effects, we cannot bear responsibility for all our communications being virus free.
We have implemented security procedures, rules and technical measures to protect the personal data that we have under our control from:
unauthorised access;
improper use or disclosure;
unauthorised modification.
All our employees and data processors, who have access to, and are associated with the processing of personal data, are legally obliged to respect the confidentiality of our visitors’ and supporters’ personal data.
If a breach of security occurs then we will contact you as soon as possible. We will keep you update on what action we are taking in response.
Ripon Museum Trust use cookies to monitor traffic to our website, which is standard practice. A cookie is a small amount of data generated by a website and saved by your web browser, which is used to remember information about you. This information does not identify you as an individual, but provides us with general information on how you use our website. We use this information to improve the content on our website to give visitors a better experience. Our website does use some cookies that are essential for it to function properly, including cookies that track when you have added a ticket to your basket.
We regularly analyse our website traffic to monitor how people interact with the site. This includes how many people visit, which external websites they have come from, which of our web pages they look at and for how long.
We use a third-party tool called Google Analytics to do this. You can find out more about how Google uses data and how to opt-out here.
Some of the third-party websites that we use, such as Mailchimp and Eventbrite, to send out our e-newsletter and to allow you to book tickets for some events, also use cookies and you should read and agree to their cookies policy before using them. Third-party cookies from YouTube and Vimeo also record how many people view embedded video content on our site.
Website users who do not want cookies to monitor their devices can opt-out via the cookie pop-up on our site, or by installing a browser add-on that tells the website not to send information to third parties, such as the Google Analytics Opt-out Browser Add-on. Please note that essential cookies will still apply for the website to function, but analytics cookies will not be used.
If you do not want to use an associated site that has cookies, then you can contact the Trust through [email protected] and we will send the necessary booking forms or information via email.
How can I access the information held about me, and amend, correct, delete it or be forgotten by the Trust?
If you are on our mailing list, there is an unsubscribe button on every email we send to you and if you select that you will automatically be removed from the list.
You can ask us if we are keeping any personal data about you and you can also request to receive a copy of that personal data – this is called a Subject Access Request.
To make a Subject Access Request you will need to provide adequate proof of identity such as a copy of your passport, birth certificate or driving licence before your request can be processed.
Please try to be as clear as possible about the information you are seeking.
Once we have received your Subject Access Request and proof of identity, you will receive a response from us within 40 days and you will be able to get copies of any information we hold on you. However, exemptions to disclosure may apply in some circumstances.
Subject Access Requests should be sent to:
Director, Ripon Museum Trust , Workhouse Museum , Allhallowgate, Ripon, HG4 1LE
Email: [email protected].
At any time you may request that we delete or correct your personal information. If you wish to correct any information on you held by Ripon Museum Trust, simply contact [email protected].
We will be happy to delete any information we hold where this does not affect our legislative requirements. We will make the relevant deletions within 5 working days, or in as reasonable time as possible.
Changes to our privacy notice
We regularly review our privacy notice, and may make changes time to time. Any changes made will be posted to this page, and will apply from the time we post them. This privacy notice was last changed on 24 March 2021.
How to contact us
If you have any comments on our privacy notice, or information we hold about you please contact us:
by email to [email protected]. ;
or write to us at Ripon Museum Trust, Workhouse Museum, Allhallowgate, Ripon, HG4 1LE