Norfolk Record Office privacy notice

What this notice is for

This privacy notice provides information on how the Norfolk Record Office (NRO) uses your personal information for the purpose of preserving and making accessible archive collections relating to and associated with Norfolk.

In addition, if you are a participant in the Change Minds project this notice also sets out how we use your information as part of this project.

By ‘use’ we mean the various ways your personal information may be processed including storing and sharing your information.

If you have previously provided consent for us to use your personal information (for example as part of a mailing list, or part of the Change Minds project) you can withdraw consent by contacting us at norfrec@norfolk.gov.uk.

Further details

We also provide further details regarding:

• Who we are
• Your rights under the General Data Protection Regulation (GDPR) (although subject to exemptions under the GDPR) and
• How to exercise them

You can see this information in Norfolk County Council's general privacy notice on the County Council’s web site or you can ask us for a copy of this information.

What we use your personal information for

We gather, retain and share historic record collections relating to Norfolk.

We use your personal information primarily for the following purposes:

• Collecting records, preserving records, managing records and making records available to the public
• Promotional activities and events management
• Rights control – including copyright declarations forms
• Providing conservation, digitalisation, and archive for third parties
• Monitoring and improving our services including carrying out surveys, questionnaires and evaluation forms
• Applications for birth, death and marriage certificates
• Administering the use of volunteers
• To provide and assess the evaluation of the Change Minds project (only if you are a participant in this project), including sending optional Change Minds wellbeing questionnaires to you up to a year after your participation in the Change Minds project

The information we collect and use

The information we may collect and use could include:

For collecting records, preserving records, making available records to the public and managing records

• Visitors name and contact details and documents used
• Depositor/donor name and contact details
• Intermediary’ name and contact details
• Provenance, custodial and evidential information
• Range of personal data held in the documents placed on deposit. This may include the following information classed as “special category data” under the GDPR as well as criminal convictions data:
  • Racial and ethnic origin
  • Political opinions
  • Religious or philosophical beliefs
  • Trade union membership
  • Sexual orientation
  • Health data including disabilities 

For rights control– including copyright declarations forms

• Name, contact details and items to which the declarations relate
• Payments processing details

For promotional activities and events management

• Name
• Contact details
• Payment processing details  

For providing conservation, digitalisation, and archive for third parties

• Name
• Contact details
• Payment processing details

For applications for birth, death and marriage certificates

• Name
• Date of event
• Place of event
• Mother's name
• Father's name
• Relationship to person on certificate
• Contact details
• Payment processing details

For administering the use of volunteers

• Name
• Contact details
• Details of referees
• References
• Any special requirements (eg adjustments for disability) (special category data)

For Change Minds (only if you are a participant in this project)

• Name
• Email address
• Demographic
• Age
• Disability (where applicable)
• Ethnicity
• Gender
• Sexual orientation
• Religion
• Mental health history (special category data)

The GDPR includes safeguards to protect the use of your special category data (information which is more sensitive). Further details can be found on our website in the document named ‘Special category data and criminal offences data policy’ which sets out our procedures for compliance with the principles of the GDPR and the retention and erasure of this information.

Who provides this information 

The information we hold includes information you have provided to us. We may also receive information from Change Minds.

How the law protects you and the legal basis for processing your information

We have the following legal grounds to process this information:

Under Article 6 (1) (e) of the GDPR because it is necessary for the performance of a task carried out in the public interest as follows:

• For collecting records, preserving records, managing records (including recording provenance) and making records available to the public
  • Public Records Act 1958 and 1967
  • Manorial Documents Rules 1959
  • Local Government (Records) Act 1962
  • Public Libraries and Museums Act 1964
  • Local Government Act 1972
  • Parochial Registers and Records Measure 1978
• For rights control – including copyright declarations forms
  • See legislation above
• For providing conservation, digitalisation, and archive for third parties
  • See legislation above
• For promotional activities and events management
  • See legislation above
• For monitoring and improving our services including carrying out surveys, questionnaires and evaluation forma
  • See legislation above
• For applications for birth, death and marriage certificates
  • The Births and Deaths Registration Act 1953
  • The Marriage Act 1949 and
  • The Civil Partnership Act 2004

Under Article 6 (1) (a) of the GDPR where you have given consent for the processing of your personal information. This includes mailing lists and Change Minds. If you have provided consent you can withdraw it at any time by emailing us at norfrec@norfolk.gov.uk.

Under Article 89 of the GDPR and Section 10 and Schedule 1 Part 1 Paragraph 4 of the Data Protection Act 2018 in relation to special category data and criminal convictions data because it is necessary for archiving purposes, is not likely to cause substantial damage or distress and is in the public interest.

Who we share your information with

We may also share your personal information with other organisations and public bodies, in particular:

• British Library
• Other records/archive offices
• Wellbeing researchers (only applies to Change Minds and if you are a participant in this project). Your information is anonymised before being shared with any researcher.

We will do this securely and with data sharing arrangements in place.

We will also share your information, subject to contractual and other legal safeguards, with organisations contracted by the NRO to provide a service to the NRO or directly to you.  These service providers are known as data processors and have a legal obligation under GDPR and to NRO to look after your personal information and only use it for providing that service. These organisations include Eventbrite which processes personal data for the purposes of the management of events.

How long we keep your information for

In respect of: 

• Information processed by consent – we will keep your information until you unsubscribe or withdraw the collection
• Information processed by consent (Change Minds if you are a participant in this project). Change Minds will keep your non-anonymised personal information for up to 15 months from the date of participation, after which time it will be destroyed. Anonymised information may be kept for up to 7 years from the date the information was provided.
• Information processed for a task in the public interest and for archiving purposes, we keep the information in accordance with the NRO’s retention and destruction schedule.

How we keep your information

We keep your electronic personal information securely on the Norfolk County Council services and your paper information in locked filing cabinets. We do not process your information outside of the UK except where we use Eventbrite for the purposes of managing events. When using Eventbrite your personal information may be transferred to the USA. Please note, when your personal information is sent to the USA we cannot guarantee the same level of protection as you would have within the UK. This is as the information may be intercepted by government agencies of the USA. Please consider this when deciding whether to use Eventbrite.  

Automated decision making

We do not make automated decisions about you.

Date of notice

This notice was updated in April 2023.