In this policy, whenever you see the words ‘we,’ ‘us’ or ‘our’, it refers to Black Country Living Museum Trust Group (BCLM). The group consists of Black Country Living Museum Trust, a registered charity (no. 504481) and limited company (no. 01226321) and Black Country Living Museum Enterprises Limited, a limited company (no. 3026731).  

BCLM is registered with the Information Commissioner’s Office under the Data Protection Act 1998, and our Data Protection Register number is: Z7620282

We are also registered with the Fundraising Regulator and are committed to abiding by the Code of Fundraising Practice and to the Fundraising Promise. 

When you interact with us:

We collect the personal data that you give when you interact with us, for example booking a ticket, joining as a member, making an online purchase, completing visitor surveys or communicating with us. If you do not provide us with the requested personal information we may not be able to properly perform our contract with you, for example we may not be able to issue you an UnChained Annual Pass when purchasing a full-priced ticket.

The information will be retained for contractual and legitimate business interest reasons and comprises: 

• Personal details (name, date of birth/age, gender, email, address, telephone number and where necessary family and spouse/partner details and ethnicity)
• Financial information (payment information such as credit or debit card or direct debit details, and whether donations are gift-aided)
• Interaction history (ticket history, attendance history)
• Details of correspondence sent to you, or received from you and your opinions  and attitudes about BCLM 

When you get involved with us:

We collect details of how you get involved with us, whether that’s by volunteering with us, working for us, through a school, college or university placement scheme, donating to our museum collection or helping with our fundraising and marketing campaigns and activities. This information will be retained for legitimate business interest reasons.

If you volunteer with us then we will collect extra information about you. This will include references, medical conditions, past experience, qualifications, details of emergency contacts, bank details to pay expenses and an image/s. This information will be retained for legal or contractual reasons.

We will also collect extra information about you if you apply to be an employee of the Museum. We will ask you about your previous experience, education, qualifications, referees and for answers to questions relevant to the role for which you have applied. You will also be asked to provide equal opportunities information. This is not mandatory information – if you don’t provide it, it will not affect your application. Any information you do provide, will be used only to produce and monitor equal opportunities statistics, so, for example, to monitor barriers to employment.

If you progress to become an employee of the Museum, further information relating to health and criminal convictions and bank account details will be sought. This information will be retained for legal or contractual reasons.

If you make a financial donation to us, we’ll keep records of how much you give to a particular cause and we’ll note anything relevant that you may tell us. This information will be retained for legitimate business interest reasons.  

If you make a donation to our collection, then we’ll keep records of you, your contact details, the item donated and anything relevant that you may tell us. This information will be retained for legitimate business interest reasons.

.

When we ask you to provide your personal information we will let you know why we are asking, and how we will use your data, by directing you towards this policy.

If you have interacted with us, for example as a visitor or Member:

We will send you essential communications, regardless of your contact preferences, deemed necessary to fulfil our contractual obligations to you.  If you book a ticket online, this would be information related to your booking or if applicable, a gift aid confirmation letter.

Or, if you are a Member we would communicate with you about items such as Direct Debit confirmations and advance notices Member benefits, renewal reminders, and querying returned mail or bounced Direct Debit payments with you.

We will send you marketing and/or fundraising communications only if you have explicitly stated that you are happy for us to do so via a preferred channel(s) (email, SMS, phone or post). Marketing information covers information from BCLM about the goods and services sold, programme of events, and other news from the Museum. Fundraising information covers appeals for specific projects and ways in which you can support our work as a Museum and charity.

We will use tools to monitor the effectiveness of our communications with you, including email tracking, which records when an e-newsletter from us is opened and/or how many links are clicked within the message. The data from this tracking is used in an aggregated and anonymised form.

If we contact you by email, every message we send you will include a link to opt-out of receiving future messages if you change your mind. If we contact you by other means and you want to change how – or if – you receive our communications, please call us weekdays between 10am and 4pm on 0121 557 9643 or email [email protected] 

We may also use anonymised personal data to carry out research on the demographics, interests and behaviour of our users and supporters to help us gain a better understanding of them and to enable us to improve our service. This research may be carried out internally by our employees or we may ask another company to do this work for us. 

If you are involved with us as a financial donor: 

All of the above applies. Plus,if you’ve told us that you are planning to, or thinking about, leaving us a gift in your will, we’ll use the information you give us to keep a record of this – including the purpose of your gift, if you let us know this. 

We will also send you thank you letters and invitations related to the work you have supported. 

If you are involved with us as a donor to our museum collection: 

We store your name, your contact details and anything relevant that you may tell us against the record of the item donated in our collections management system. 

If you are involved with us as a worker or employee: 

We need to process personal data from job applicants and employees in order to comply with our contractual, statutory, and management obligations and responsibilities. 

All of the information you provide during the application process will only be used for the purpose of progressing your application, or to fulfil legal or regulatory requirements if necessary. We will not share any of the information you provide during the recruitment process with any third parties for marketing purposes. The information you provide will be held securely by us whether the information is in electronic or physical format. 

We will use the contact details you provide to us to contact you to progress your application. We will use the other information you provide to assess your suitability for the role for which you have applied. You don’t have to provide what we ask for but it might affect your application if you don’t. 

If you are involved with us as a volunteer or through a school, college or university placement scheme: 

We need to use your personal data to manage how you are involved with us, for example, as a volunteer, to contact you about an expense claim you’ve made or to recognise your contribution.

If you have interacted with us, for example as a visitor or Member:

We continuously review records of visitors and supporters to ensure your data is as accurate as possible and therefore we really appreciate it if you let us know if your contact details change. However, we will also consult alternative sources in order to undertake these checks or to complete essential missing information, for example a missing post code for Gift Aid purposes.

We will also update bank details, if we are notified by your bank that details linked to Direct Debits or any outstanding payments due to us have changed and would therefore affect these payments.

Where we appoint an external party to undertake a cleansing of information, any such arrangements will be subject to a formal agreement between Black Country Living Museum and the organisation, to protect the privacy and security of your data. 

If you are involved with us as a volunteer, worker or employee: 

We ask that you keep us up to date if any of your personal details change but we will write to volunteers and employees periodically to ensure personal information is as up to date as possible.

We do not disclose personal data to any third parties or external organisations, other than data processors carrying out work on our behalf unless we are legally and/or contractually required to do so, e.g. by a law enforcement agency legitimately exercising a power or if compelled by an order of the Court.

Examples of data processors carrying out work on our behalf would be mailing agencies for the sending of Membership information, Secure hosting for transactions made through our online shop, data cleansing organisations or for employees, our payroll provider. 

Any such companies are acting as approved data processors for Black Country Living Museum and we retain full responsibility for your personal data. Data processors will act only on our instructions. 

Some of our suppliers run their operations outside the European Economic Area (EEA). Although they may not be subject to the same data protection laws as companies based in the UK, we will take steps to make sure they provide an adequate level of protection in accordance with UK data protection law.

Your data will never be sold or passed to any third party for any other purpose.

If you have interacted with us, for example as a visitor or Member

As a visitor or supporter of BCLM, your personal data will be held and processed on the Museum’s customer relationship management system (CRM). This system holds your contact details and a record of your interactions with BCLM such as ticket purchases, donations, memberships, queries, complaints and attendance at events. Where possible we aim to keep a single record for each customer. 

Your data is always held securely. Access to customer information is strictly controlled. The CRM system can only be accessed by people who need it to do their job. Certain data, for example some sensitive information, is additionally controlled and is only made visible to members of staff who have a reason to work with it.

If we use external companies to process your personal data on our behalf, we undertake comprehensive checks on these companies before we work with them, and put a contract in place that sets out our expectations and requirements, especially regarding how they manage the personal data they have collected or to which they have access.  

If you are involved with us as a donor to our museum collection:

As a donor to our museum collection your personal data will be held and processed on the museum’s collection management system against the record of the item donated.

Your data is always held securely with access strictly controlled. The system can only be accessed by people who need it to do their job.

If you are involved with us as a volunteer, worker or employee:

As a volunteer or employee your personal data is kept across a number of different electronic and hard copy systems to meet the business needs of the Museum.  The Museum has policies and procedures in place to ensure that your information is only accessible by individuals that need it to do their job.

Certain data, for example some sensitive information, is additionally controlled and is only made visible to members of staff who have a reason to work with it. However there will be other data, for example BCLM email addresses and job titles, which is accessible to all staff and will be in the public domain. 

If we use external companies to process any volunteer or employee data on our behalf, we do comprehensive checks on these companies before we work with them, and put a contract in place that sets out our expectations and requirements, especially regarding how they manage the personal data they have collect or have access to. 

We will only use and store your data for as long as it is required for the purposes it was collected. The period of retention depends on the information being held, what it is being used for and in some cases, legal requirements (for example the collection of Gift Aid which we are legally required to keep for six years).

We keep a retention of records policy detailing all of this information. When we no longer need to store your data we will always dispose of it securely.

You can ask us if we are keeping any personal data about you and you can also request to receive a copy of that personal data – this is called a Subject Access Request.

To make a Subject Access Request you will need to provide adequate proof of identity such as a copy of your passport, birth certificate or driving licence before your request can be processed.

Please try to be as clear as possible about the information you require including where the data is likely to be held and the date range of the information you wish to access.

Once we have received your Subject Access Request, and proof of identity, you will receive a response from us within 30 days and you will be able to get copies of any information we hold on you. However, exemptions to disclosure may apply in some circumstances.

A Subject Access Request should be sent to:

Information Governance Officer

Black Country Living Museum Trust

Tipton Road

Dudley

West Midlands

DY1 4 SQ

Email: [email protected] 

At any time you may request that we correct or delete your personal information – which we will do as long as there are no legitimate, legal reasons (as outlined in the general data protection regulation) for us to retain and process that data, for example if it’s necessary for us to carry out the purpose for which you have provided it to us. In either of the above circumstances, please contact [email protected]

For further information see the   Information Commissioner’s guidance  on the Information Commissioner’s Office website. 

Children’s data

Some of the services we offer are aimed specifically at children, for example our Hands-on-Heritage activities and Santa Hunts, and to deliver these services effectively it is necessary for us to collect data such as first name, age, emergency contact details, and any relevant medical information. We will only store this information on our database until the services are fulfilled upon which the data will be deleted. Before we collect data from anyone under 16 we will always ask them to obtain the permission of a parent or guardian before giving it to us.

We won’t send marketing communications, nor request donations from children under 16.

Closed Circuit Television (CCTV)

We use CCTV equipment to provide a safer, more secure environment for visitors and staff and to prevent vandalism and theft. It is used for:

• The prevention, investigation and detection of crime.
• The apprehension and prosecution of offenders (including use of images as evidence in criminal proceedings).
• Safeguarding public, members and staff safety.
• Monitoring the security of our premises.

Access to the CCTV recorded footage is limited to designated staff and other authorised personnel (including police) with a legitimate reason to view and/or otherwise use the captured footage, including the provision of evidence in support of prosecution of criminal or illegal behaviour. Authorisation to review any footage will be given to relevant parties on a case by case basis which will be determined at the discretion of the Museum Director or a Deputy Chief Executive in accordance with applicable data protection legislation.

As the recording system records digital images, any CCTV images that are held on the hard drive of a PC or server are deleted and overwritten on a recycling basis and, in any event, are not held for more than 30 days.

However, where a law enforcement agency is investigating a crime or information is required for an insurance claim, images may need to be retained for a longer period. Further details governing the use of CCTV can be found in our CCTV Policy.

Museum photography & videography

If you’re a visitor to the Museum we may ask you to participate in Museum photography and/or videography. If you’re happy to do so, we will ask you to sign a model release form permitting us to use the image/film in Museum marketing activity including on the Museum’s website, on its social media channels, in its leaflets and posters. For visitors under 16 years of age, we will ask a parent or guardian to sign the model release form.

When we ask you to provide your personal information on the model release form, we will let you know why we are asking, and how we will use your data, by directing you towards this policy.

If there is photography and/or videography taking place at the Museum in which a visitor might be inadvertently and unidentifiably photographed and/or filmed, we will make the photography and/or videography known at the point of admissions and direct to this notice.

Links to third party websites

Pages on the BCLM website include links to third party websites that we believe might be of interest to our website visitors. This privacy policy only governs our website and we are not responsible for the privacy policies that govern third party websites even where we have provided links to them.  If you use any link on our website we recommend you read the privacy policy of that website before sharing any personal or financial data.

Use of ‘cookies’

Like most websites, we receive and store certain details whenever you use our website.  We use “cookies” to help us make our site – and the way you might use it – better. Cookies mean that a website will remember you and enable online transactions. It also helps us understand how you use our website, where we can make improvements and how best to tell our audiences about events they might be interested in. For full details, please see our cookies policy, available on our website.

Social media

We use social media (including Facebook, Twitter, Instagram and Youtube and TikTok) to broadcast messages about our news and events. Although this policy covers how we will use any data collected from those pages it does not cover how the providers of social media websites will use your information. Please ensure you read the privacy policy of the social media website before sharing data and make use of the privacy settings and reporting mechanisms to control how your data is used.

We regularly review our privacy notice, and may make changes from time to time. Any changes made will be posted to this page, and will apply from the time we post them. This privacy notice was last updated in May 2018.