Data Privacy Policy

Introduction – The Friends of Penlee House Gallery and Museum needs to gather, store and use certain forms of information about our members in order to operate. This policy explains how we collect, store and use this data in order to comply with the law. 

1. Your personal data – what is it? 

Personal data relates to an identifiable person who can be identified from that data. Identification can be by the information alone or in conjunction with any other information in the data controller’s possession or likely to come into such possession. 

The Friends of Penlee House Gallery and Museum is committed to ensuring that all personal data collected is processed in accordance with all relevant data protection laws including the General Data Protection Regulation (GDPR) and the Data Protection Act 2018 (DPA 2018). 

2. Who we are:

The Friends of Penlee House Gallery and Museum is an independent Registered Charity (Charity number: 1001644) formed in 1987 with the object of supporting Penlee House Gallery and Museum in its cultural and educational activities. Referred to as the ‘Friends’ within this Privacy Policy, there are well over 1500 fully subscribing members and a further database of supporters, making it one of the largest ‘Friends’ organisations outside London.

The Trustees are mindful of the need to protect your privacy and will take all necessary measures to ensure that there are no infringements. 

3. The legal basis for processing information relating to members and supporters:

To collect, process or store your personal information, The Friends of Penlee House (as data controller) must have a legal basis for doing so under data protection legislation, this can arise as either when there is a contractual relationship between you and us, for example when you become a subscribing member of the ‘Friends’, or it can arise when you give us consent, for example if you make a donation to the ‘Friends’, or also when you opt to receive the brief news bulletins that we issue from time to time by email.

When you give us your consent (which you can withdraw at any time), you are agreeing to ‘The Friends of Penlee House’ processing your information in accordance with this privacy notice.

Having a contractual relationship or giving consent are not the only legal bases under which we can acquire and process your personal information. We do not require your consent to process your personal information if you interact with us in other ways, for example when you:

• register for an event.
• buy goods from us in our shop or online.
• register as a volunteer.
• fundraise on our behalf.
• submit an enquiry.

or when you:

• make your information publicly available yourself.
• or someone else needs protecting in an emergency.

4. When you indirectly give us information

Website cookies Cookies are text files placed on your computer to collect standard internet log information and visitor behaviour information. This information is used to track visitor use of the website and to compile statistical reports on website activity. All visitor tracking is anonymous. For further information about website cookies visit www.aboutcookies.org or www.allaboutcookies.org

You can set your browser not to accept cookies and the above websites tell you how to remove cookies from your browser. 

Other websites/social media platforms Our website contains links to other websites. This privacy policy only applies to the Friends website so when you link to other websites you should read their own privacy policies. 

When you interact with us on social media platforms such as Facebook, Instagram, WhatsApp or Twitter we may also obtain some personal information about you. The information we receive will depend on the privacy preferences you have set on each platform and the privacy policies of each platform.

To change your settings on these platforms, please refer to their privacy notices.

5. What information might we collect

When you engage with us by phone, mail, in person or online, we may collect information about you (referred to in this Privacy Notice as ‘personal information’). This may include your name, address, email address, telephone number, date of birth and other information relating to you personally which you may choose to provide to us.

Sensitive information will only be collected where necessary, for example, we may need to collect health information from you when you register as a volunteer. Clear notices will be provided at the time we collect this information, stating what information is needed, and why.

6. If you are under 16

If you are aged under 16, you must get your parent or guardian’s permission before you provide any personal information to us.

7. How and why we use your information

We will use your personal information for the following purposes:

• Administration: We may use your personal information to process subscriptions from subscribing members of the ‘Friends’, to record and deal with a complaint, record a request not to receive further marketing information, record what our volunteers have done for us, and for other essential internal record keeping purposes.
• Data Matching and Segmenting: We may, for the purposes of our legitimate interests, use your personal information to conduct profiling. This enables us to target communications in a more focused, efficient and effective way, helping us reduce the chances of supporters, members or donors receiving inappropriate or irrelevant communications. You can object to such use of your personal information for profiling at any time by contacting using the details set out at the end of this Privacy Notice.
• Monitoring and Evaluating: We may use your information in order to improve current and future delivery of our services to you.
• Market research and surveys: We may invite you to participate in surveys or market research to help us improve our services. Participation is always voluntary. No individuals will be identified as a result of this research unless you consent to us publishing your feedback.
• Responding to a request: If you contact us with a query, we may use your personal information to provide you with a response.
• Transactional purposes: We will need to use your personal information in order to carry out our obligations arising from any contracts entered into between you and us for goods or services, for example, processing your order and payment for a product from our online shop.
• Fundraising: We will only send you marketing information by email, SMS, or phone if you have given us specific consent. If you withdraw your consent and then subsequently opt in to receive marketing information again, then your most recent preference may supersede. If you respond to a fundraising appeal by post, you may also receive fundraising mail, which you can opt out of at any time.
• Donation processing: We will process personal information you provide in order to administer any one-off or on-going donations you make and to claim Gift Aid. We may use a donation processing partner to handle your donation and they in turn will have a privacy policy that you should read.

8. Information use, storage and protection

The information which you provide on paper or via electronic forms is used as follows:

• Membership Data is used to maintain a Friends Members Electronic Database and to enable us to communicate with you by post, email or telephone (e.g. sending out the ARTeFACT) and to record receipt of your membership subscriptions or donations. 

Data may also be used for in-house fundraising purposes.

• Gift Aid Declarations are used to compile an electronic database of members and donors who agree that the tax paid on their subscriptions and donations may be claimed back under the HMRC Gift Aid scheme. The database is used to facilitate, apply for and record the periodic collection of tax refunds from HMRC. 

The Friends’ Database and the Gift Aid database are for use strictly ‘In-House’ and are only available to designated officials and administrators of the Friends’ Charity for the achievement of the purposes previously described.

1. The Direct Debit Database is compiled both from the Direct Debit agreement forms and from data that you provide to our Bank to Bank payment facilitator – Stripe Payments UK Limited
2. Stripe Payments UK Limited is regulated by the UK Financial Conduct Authority (reference number: 900461
3. Data that you provide to Stripe is used only to enable the collection of members’ subscriptions by direct debit or one-off payments through the UK Banking System.

         The Stripe Privacy Policy can be found here: https://stripe.com/gb/privacy

Information on members held by the ‘Friends’, both on paper and electronically, will be retained for as long as membership continues. Most information held, either on paper or electronically, on members who leave will be deleted or destroyed after four years. The exceptions are Gift Aid Forms and the Direct Debit forms which will be destroyed and the corresponding data will be deleted from the databases 6 years after the end of the financial year when the member leaves or withdraws from the scheme. 

We adopt safeguards to ensure that your personal information is secure. We limit access to information on a need-to-know basis and take appropriate measures to ensure that our people are aware that such information is only used in accordance with this Privacy Policy.

We undertake regular reviews of who has access to information that we hold to ensure that your information is only accessible by appropriately trained staff, volunteers and contractors.

If you use your credit or debit card to donate to us, buy something, pay a subscription or to make a booking online, we pass your card details securely to our payment processing partners. Your payment details will be stored by our processing partners. Please be aware that there are inherent risks in sending information over public networks and at all times you should remain vigilant when making payments.

9. Information retention

In respect of personal information, we will retain your personal information for no longer than necessary for the purposes for which it was collected and as described herein or in other privacy notices provided to you, taking into account guidance issued by the Information Commissioner’s Office.

In respect of subscribing members and donors, we will keep personal information relating to financial transactions for as long as the law requires us to for accounting purposes – which currently may be up to six years.

If you unsubscribe from our emailing service or cancel your membership of the Friends of Penlee House, we will keep a record of the fact that you have done so.

10. Your rights over your personal information

Data protection legislation gives you the right to request access to personal information about you which is processed by the Friends. Your rights include:

• The right of access to a copy of the information contained in their personal data; 
• The right to object to processing that is likely to cause or is causing damage or distress; 
• The right to prevent processing for direct marketing; 
• The right to object to decisions being taken by automated means; 
• The right in certain circumstances to have inaccurate personal data rectified, blocked, erased or destroyed; and 
• The right to claim compensation for damages caused by a breach of the Act

You can request:

• that your information be amended or corrected if there are inaccuracies
• a cessation of any processing for which you have previously given consent.
• the erasure of your personal information where it is no longer necessary for us to retain it.

To exercise your rights, please use our contact details shown below, provide valid evidence of your ID, any information that is relevant and details that will assist us in locating your records.

You are only entitled to your own personal data, and not to information relating to other people. If your request is manifestly unfounded or excessive, we can refuse to deal with it in which case we will provide you with an explanation of this decision.

11. Who do we share your information with?

We will only use your information for the purposes for which it was obtained. We will not, under any circumstances, sell or share your personal information with any third party for their own purposes, and you will not receive marketing from any other companies, charities or other organisations as a result of giving your details to us.

12. We will only share your data for the following purposes:

Third party suppliers: We may need to share your information with data hosting providers or service providers who help us to deliver our services, projects, or fundraising activities and appeals. If we invite you to an event or to take part in a survey, we may use a separate organisation to administer the booking or the survey. You will be giving your information directly to them and they will process it and pass the necessary details to us. We recommend that you read their Privacy Notice.

13. Use of data processors:

Data processors are third parties who provide elements of our services for us. For example, we utilise the services of ‘Mailchimp’ as data processors and to store your data. Data processors cannot do anything with your personal information unless we have instructed them to do it. They will hold your information securely and retain it for the period we instruct them to.

14. Where legally required: Where disclosure is required by law, for example, we may disclose your personal information to the government for tax (gift aid) purposes, or to law enforcement agencies for the prevention and detection of crime. We may also share your information with the emergency services if we believe that there is a risk of serious harm to you or someone else.

We aim to ensure that personal information is only used by those third parties for lawful purposes in accordance with this Privacy Notice.

15. Contact details  To exercise all relevant rights, queries, concerns or complaints, in the first instance, please contact:

The Friends of Penlee House

Data Protection Officer

Penlee House Gallery & Museum

Morrab Road

Penzance

Cornwall

TR18 4HE

Telephone Penlee House Gallery & Museum: 01736 363625

website: www.friendsofpenleehouse.org.uk

16. Information Commissioner’s Office

If you are not happy with the response you receive to your concerns, then you can raise that concern with the relevant statutory body:

Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire. SK9 5AF

Helpline number: 0303 123 1113

ICO website: https://www.ico.org.uk

This document has been produced using, among other sources, the guidelines to the Data Protection Act 2018 issued by NCVO. The policy will be subject to annual review by the Trustees and also amended as necessary when regulations are changed or new ones introduced.

Reviewed: April 2023