Norfolk Museums Service privacy notice

What this document is for

This privacy notice provides further information on how we, the Norfolk County Council's Museums Service (the Museums Service), uses your personal information.
By 'use' we mean the various ways it may be processed, including collected, storing and sharing the information.

Further details

We also provide the following details in our general privacy notice on our website:

who we are
how long we use your information for
your rights under the UK General Data Protection Regulation (the GDPR) and
how to exercise them

You can ask us for a copy of this information.

What we use your information for

We may use the information about you to:

provide access to museums and learning and training including study groups, educational activities and tours
administer museums membership including Norfolk Museums Pass and e-newsletters
provide e-newsletters to subscribers
design, and administer events and exhibitions including issuing tickets for these events
administer archives and collections including object ownership, provenance, location control, due diligence, audit trail
monitor and improve our services including carrying out surveys, questionnaires and evaluation forms and carrying out statistical analysis about who visits and uses its services so the Museum Service can better understand its audiences
provide conservation services including restoration, maintenance and quotations for these services
arrange, provide, and administrate training
provide work experience for students
to protect you, us, and our exhibits (CCTV is in operation at our sites).

We also use this information to assess the quality of our services and evaluate and improve our policies and procedures.

We may also use information in other ways compatible with the above.

What personal data we collect and use about you

We collect and use some basis details about our visitors, members, supporters, donors/lenders and partners. This may include:

Personal details: Name, date of birth/age
Contact details: Address, phone number and email address
Education: Schools or colleges attended/ currently in education and further education
Social Relationships: Next of kin and emergency contacts
Financial: Payments made and bank details
Employment history: Job profession and references
Your image through CCTV footage (premises covered by CCTV are identified by signs)
Photos, videos and audio recordings (these are only collected with your prior consent, this will be explained to you in more detail if we ask for your consent)

We may also collect information about health including disabilities in respect of students on work experience. This data is classed as "special category data" under the GDPR. We may only collect these data when it is relevant and for the purposes described above.

The GDPR includes safeguards to protect the use of your special category data. Further details can be found on our website in the document named 'Special category data and criminal offences data policy' which sets out our procedures for compliance with the principles of the GDPR and the retention and erasure of this information.

Who provides this information

We receive most of this information from you, but we may also obtain some of this data from your parent or carer if relevant.

Who we share your information with

We may share the name of a lender/donor of an object to the Museum Service with other institutes and organisations for the purpose of loaning exhibits.

We may also share your information across different departments of Norfolk County Council, where it is necessary for our public tasks or functions to do so.

We also share your information to third parties contracted by the County Council to provide a service to the County Council for example, to provide the Museums Pass. These service providers are known as data processors and have a legal obligation under GDPR and to the County Council to look after your personal information and only use it for providing that service.

We may process your information outside of the European Economic Area, in certain circumstances. For some events and services we utilise the service providers; Eventbright, and Mailchimp, whose servers are hosted outside of the European Economic Area. Find out more about how they use your information:

How the law protects you and the legal basis for processing your information

We have legal grounds to process this information because it is necessary for the performance of a task carried out in the public interest. This includes tasks under the Public Libraries and Museums Act 1964.

We also have legal grounds to process special category data where it is in the exercise of a statutory function and it is in the necessary for reasons in the substantial public interest. The statutory function is set out above.

We may also process your information when you provide consent for us to do so. For example, if you consent to photos, videos or audio recordings. More information about this will be provided to you when we seek your consent.

How long will we keep your personal information for

In the case of collections acquisitions and management the Museums Service will retain your personal information permanently as this is a key unit of information which informs provenance and due diligence policy.

All other information will be retained in line Norfolk County Council policy.

How we keep your information

The Museums Service keeps:

electronic records securely in restricted access hard drives
paper secure files in locked cabinets
for the purposes of the Museums Pass and tickets for courses, the Museums Service use the Recreate X system software system provided by Gantner.
We retain CCTV footage for a minimum of 28 days and a maximum of 31 days, in accordance with the British Standard.

Automated decision making

We do not make automated decisions about you and your family.

Changes to this notice

We may amend this privacy notice at any time so please review it frequently. The date below will be amended each time this notice is updated.

Date of notice

This notice was updated in October 2023.