What this document is for
This privacy notice provides further information on how we, the Norfolk County Council’s Museums Service (the Museums Service), uses your personal information.
By ‘use’ we mean the various ways it may be processed, including collected, storing and sharing the information.
We also provide the following details in our general privacy notice on our website:
- who we are
- how long we use your information for
- your rights under the UK General Data Protection Regulation (the GDPR) and
- how to exercise them
You can ask us for a copy of this information.
What we use your information for
We may use the information about you to:
- provide access to museums and learning and training including study groups, educational activities and tours
- administer museums membership including Norfolk Museums Pass and e-newsletters
- provide e-newsletters to subscribers
- design, and administer events and exhibitions including issuing tickets for these events
- administer archives and collections including object ownership, provenance, location control, due diligence, audit trail
- monitor and improve our services including carrying out surveys, questionnaires and evaluation forms and carrying out statistical analysis about who visits and uses its services so the Museum Service can better understand its audiences
- provide conservation services including restoration, maintenance and quotations for these services
- arrange, provide, and administrate training
- provide work experience for students.
We also use this information to assess the quality of our services and evaluate and improve our policies and procedures.
We may also use information in other ways compatible with the above.
What personal data we collect and use about you
We collect and use some basis details about our visitors, members, supporters, donors/lenders and partners. This may include:
- Personal details: Name, date of birth/age
- Contact details: Address, phone number and email address
- Education: Schools or colleges attended/ currently in education and further education
- Social Relationships: Next of kin and emergency contacts
- Financial: Payments made and bank details
- Employment history: Job profession and references
We may also collect information about health including disabilities in respect of students on work experience. This data is classed as “special category data” under the GDPR. We may only collect these data when it is relevant and for the purposes described above.
The GDPR includes safeguards to protect the use of your special category data. Further details can be found on our website in the document named ‘Special category data and criminal offences data policy’ which sets out our procedures for compliance with the principles of the GDPR and the retention and erasure of this information.
Who provides this information
We receive most of this information from you, but we may also obtain some of this data from your parent or carer if relevant.
Who we share your information with
We may share the name of a lender/donor of an object to the Museum Service with other institutes and organisations for the purpose of loaning exhibits.
We may also share your information across different departments of Norfolk County Council, where it is necessary for our public tasks or functions to do so.
We also share your information to third parties contracted by the County Council to provide a service to the County Council for example, to provide the Museums Pass. These service providers are known as data processors and have a legal obligation under GDPR and to the County Council to look after your personal information and only use it for providing that service.
We may process your information outside of the European Economic Area, in certain circumstances. For some events and services we utilise the service providers; Eventbright, and Mailchimp, whose servers are hosted outside of the European Economic Area. Find out more about how they use your information:
How the law protects you and the legal basis for processing your information
We have legal grounds to process this information because it is necessary for the performance of a task carried out in the public interest. This includes tasks under the Public Libraries and Museums Act 1964.
We also have legal grounds to process special category data where it is in the exercise of a statutory function and it is in the necessary for reasons in the substantial public interest. The statutory function is set out above.
How long will we keep your personal information for
In the case of collections acquisitions and management the Museums Service will retain your personal information permanently as this is a key unit of information which informs provenance and due diligence policy.
All other information will be retained in line Norfolk County Council policy.
How we keep your information
The Museums Service keeps:
- electronic records securely in restricted access hard drives
- paper secure files in locked cabinets
- for the purposes of the Museums Pass and tickets for courses, the Museums Service use the Recreate X system software system provided by Gantner.
CCTV – Surveillance Videos and Images
At some of our venues we operate video surveillance (CCTV). The use of CCTV is made clear by signage at the location. Your image may be captured by CCTV cameras which are in operation. We use CCTV to protect you, us, and our exhibits.
We retain CCTV footage for a minimum of 28 days and a maximum of 31 days, in accordance with the British Standard.
Automated decision making
We do not make automated decisions about you and your family.
Changes to this notice
We may amend this privacy notice at any time so please review it frequently. The date below will be amended each time this notice is updated.
Date of notice
This notice was updated on 18 January 2022.