Privacy Notice

Welcome to the Museum Development North privacy notice. We are committed to the protection of your privacy and your rights.

As a Partnership, we are committed to working with everyone in the museum community through our values:

• Trusted
• Supportive
• Collaborative
• Inclusive
• Informed

The aim of this document is to share how we collect, store and use the personal information you give to us. We want to ensure that you stay informed and are confident about giving us your information.

Museum Development North is a partnership, formed to deliver activity funded by Arts Council England. The partnership includes the following parties:

• York Museums Trust – Lead Partner
• Newcastle City Council for and on behalf of Tyne & Wear Archives & Museums
• University of Manchester on behalf of The Manchester Museums Partnership
• Cumbria Museum Consortium

For the purpose of data sharing, the following parties only are joint controllers of personal data because they are involved in decisions about the purposes and means of processing the data:

• York Museums Trust
• Newcastle City Council
• University of Manchester

We comply with the General Data Protection Regulation (GDPR 2021), the Privacy and Electronic Communications (EC Directive) Regulations 2003 and other relevant legislation. Each of the joint controllers is registered with the Information Commissioner.

As joint controllers of personal data, the responsibilities of the parties are set out in the Museum Development North Partnership Data Sharing Protocol, as required under both the UK GDPR/Part 2 of the DPA 2018 and under Part 3 of the DPA 2018.

How to contact our Data Protection Officer

As the MD North Partnership Lead Partner, York Museums Trust is the Partnership’s contact for data privacy.

If you request information on data held about you, this is called a Subject Access Request.

Requests should be submitted to:

Email: enquiries@ymt.org.uk

Phone: 01904 687687

In writing: Data Protection Officer, York Museums Trust, St Mary’s Lodge, Marygate, York, YO30 7DR

When a Subject Access Request is received by York Museums Trust on behalf of the MD North Partnership, York Museums Trust will inform all partners of the request. If a Subject Access Request for the MD North Partnership is received by one of the other partners, this will be referred to York Museums Trust.

Subject Access Requests can be submitted to each and all partners of the MD North Partnership involved in data sharing as joint controllers of the data. As joint controllers, each of the partners is responsible for responding to their own organisational requests for data access. All controllers remain responsible for their own compliance with Data Protection law, including Subject Access Requests.

Our promise

It is important to us that the museums we are contracted to work with receive the maximum benefit from the MD North Partnership programme. To achieve this, we need to manage the personal data of individual people who work or volunteer in museums. We want you to be able to participate in all aspects of our work, knowing that we are treating your personal data in an appropriate, safe and confidential manner.

We promise:

• To be clear about why we need to collect your personal information and what we would like to use it for
• To never share or sell your personal information
• To make sure that our suppliers and partners who undertake work for the Partnership meet the same high standards that we hold when handling your personal information
• To ensure your personal data is up to date, safe and secure at all times
• To make it easy for you to let us know how you would like us to keep in touch

Why do we collect personal data?

We collect personal data (any information which identifies you, or can be identified as relating to you personally) that helps us to fulfil our purpose, which is providing business-to-business support for the organisational development of museums through a variety of functions, including but not limited to: relationship management, one-to-one support, training, grant-giving, networking facilitation, event management, consultancy procurement and sector communications.

Our business-to-business support is achieved by working with a wide range of individuals who may be in an employed or voluntary role in a single site museum or multi-site museum service, or who provide contracted professional services as suppliers to museum organisations. Some individuals may be involved with one or more different museum organisations in different capacities.

To provide business-to-business support, the MD North partners receive, store and process personal data from individuals who are Data Subjects for the legal purposes of data protection.

Information relating to a museum organisation is not personal data, and in most cases our general information will be at an organisational level and is not subject to data protection.

Why is data sharing necessary between the joint controllers?

The partners collaborate as a single operational team, employed across three organisations. The sharing of personal data across the partner organisations is necessary to:

• Deliver training events
• Undertake relationship management
• Administer grants
• Administer sector communications

By sharing data for these activities, the Partnership seeks to:

• Benefit the individuals who engage on behalf of their museum organisations by developing their capability to manage effective museums by developing their skills, knowledge and contacts
• Benefit society more widely by developing museum organisations to be sustainable, inclusive and dynamic so that they can each fulfil their unique social purpose for the benefit of the people, communities and society they serve.

What personal data do we collect?

We collect personal data that enables us to deliver and improve our services. We always seek to collect the minimum amount of personal data required for the service being delivered.

Personal data we collect includes:

• Name
• Job title or museum role
• Address
• Telephone number
• Email address
• Online account handle
• Access needs
• Dietary needs

We may collect this information through booking forms, grant applications, subscriber consent forms, emails and other communications and contact with you.

When you visit our website, we collect standard technical information including the internet protocol (IP address) used to connect your device to the internet. We also collect information about your visit to the website.

We also collect and use your personal information by using cookies on our website – please see our cookie notice.

We usually collect and process your personal data on one or more of the lawful bases of: consent, contractual necessity, or legitimate interest.

Sensitive personal data

Special category data, sensitive data and criminal offence data are subject to a higher level of protection. The Museum Development North Partnership does not routinely collect data of these types.

Sensitive personal data includes data relating to: race, ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic, biometric and health data, sex life, sexual orientation, and information relating to criminal convictions and offences.

Due to the nature of confidential, development conversations that take place in the delivery of our work, some information of this type may be disclosed by individuals to employees of the Partnership. Unless the individual has given consent, the partners undertake that MD North Partnership employees will treat any such information confidentially, that they will not record, collect or process this information, and that they will not share this information.

What do we do with your information?

Processing

We will use your data to:

• make sure that you receive the service that you have requested
• send you information relating to that service, including relevant new opportunities
• request feedback on the service provided
• communicate with you about our services and relevant information from other providers

If you have given us permission to email you by signing up to our communications we use this information to send you newsletters direct to your email inbox. If you ever wish to unsubscribe from MD North Newsletters, please use the unsubscribe link at the bottom of the email.

If you have booked to attend a session or meeting that we are delivering, we use the information you provide to organise and run the event, including logistics, access and dietary requirements where relevant, and giving access to an online delivery platform.

Marketing and communications

You can choose how you would like to receive information from us and you can change your mind at any time; we will keep your preferences up to date.

If you wish to unsubscribe, please use the link provided in our communication with you, or contact us at: news@museumdevelopmentnorth.org.uk.

If you choose not to receive communications from us, then you may not hear about events or other work that may be of interest to you.

Who has access to your information?

Your personal information will only be accessible to relevant staff, volunteers and contractors working in or with the Museum Development North team in the partner organisations, who are trained to use data appropriately for them to carry out their roles in line with our Privacy Notice. We use your personal data to deliver our services to you.

We will only share your personal information beyond the Partnership where we are legally required to do so, or we have engaged a supplier or contractor to undertake services on our behalf, such as carrying out research and analysis.

We only work with trusted suppliers and contractors who have demonstrated to us that they comply with the General Data Protection Regulation and other relevant legislation.

We will never sell your information or let other organisations use it for their own purposes.

Your rights

Where the Museum Development North Partnership is using your personal data on the basis of your consent, you have the right to withdraw that consent at any time. You also have the right to ask us to stop using your personal data for marketing purposes.

You can change your preferences with us by unsubscribing from email communications, using the link at the bottom of each of our communications with you.

You can also contact us via: hello@museumdevelopmentnorth.org.uk.

The Data Protection Act 1998 and the UK General Data Protection Regulations 2021 give you certain rights and you can read these in full here.

Subject Access Requests

If you would like further information on your rights or wish to exercise them in a Subject Access Request, please write to us at:

Data Protection Officer, York Museums Trust, St Mary’s Lodge, Marygate, York, YO30 7DR

You can:

• Withdraw your consent by asking us to stop emailing you
• Ask us to update our records
• Ask us to consider a request from you to stop processing your data
• Complain or discuss the way that we are handling your information

Keeping your information safe

The security of your information is very important to us and our networks are regularly monitored to ensure that they remain secure.

We only use and store your information for as long as it is reasonably necessary for the purposes it was collected for. The length of time the partners will keep your information will depend on the information itself, what it is being used for, and our statutory legal, funding or taxation requirements.

All our staff received Data Protection awareness training and we have a dedicated Data Protection Officer. Refresher training is provided at regular intervals to all our teams and bespoke training is provided for staff with specific Data Protection responsibilities.

How do I complain?

If you are not happy with the way your information is being handled, or with the response received from us, you have the right to log a complaint with the Information Commissioner’s Officer at Wycliffe House, Water Lane, Wilmslow, SK9 5AF.

Museum Development North Partnership

February 2024