Oswestry Town Muesum is committed to protecting and respecting your privacy, so this policy explains when and why we collect personal information, how we use it, when and why we might share it and how we keep it secure. It also details your rights in relation to your personal information. The policy will be updated from time to time so please check this page occasionally.

How do we collect personal information?

We collect information when someone registers as a volunteer or participant, uses our website to contacts us, register for an event, register for our newsletter or make a donation. We also collect your information via email, over the phone, in person, office or at an event organised by us or somebody else. Information might be provided in digital form, verbally or in writing, and be received directly from you or from a third-party you have permitted to do so.

What personal information do we collect?

We would normally collect your title, name, address, occupation, email address, date of birth, phone numbers, emergency contact details, specific needs and access requirements or bank or card details to set up a single or regular payment.

When do we collect information

We collect information about you when you complete an agreement to work with Oswestry Town Musueum. We keep your contact details, information about your areas of interest and the courses you have selected.

When making a payment, your payment is collected by a third-party processor, who specialise in secure online processing of transactions. When visiting our website, we will also record your IP address, and information regarding the pages you access. We use small files known as cookies to monitor usage of our website including visitor numbers and page views.

If you visit one of our pages that includes external content (e.g. YouTube), you may be presented with cookies from these websites; you should check these third-party websites for more information about their cookies. You can disable cookies when using our website, though some of the functionality may be affected. We use Google Analytics to understand how people use our website so we can make it more effective. Google Analytics collects anonymous information about activity on our website using cookies.

Consent

Consent means offering you a real opportunity to state whether or not you wish to allow the processing of your personal information. When processing your information based on consent, we will ensure you are fully aware of what you are consenting to and only use your information for that purpose. You can withdraw your consent at any time.

Who do we share personal information with?

Oswestry Town Muesum will not share your information with third parties for marketing purposes and will not sell or rent your information to third parties. If you use your credit or debit card to donate to us, buy something or make a booking online, we pass your credit card details securely to our payment processing partner as part of the payment process in accordance with the Payment Card Industry Standard. Our payment processing partners are Payment Card Industry Data Security Standard (PCI DSS) compliant and do not retain your personal details.  Oswestry Town Muesum may share your personal information with third parties outside of the European Economic Area if any of the exemptions detailed in the General Data Protection Regulation are met. In the case of data processors in the USA, only those certified under the U.S. Privacy Shield framework regarding the collection, storage, transfer, use and other processing of personal data will be utilised.

Right of access

You may obtain a copy of the personal information we hold about you by submitting your request to the contact details above. We will reply within one month of receipt of your request unless there is a compelling reason to extend this response time. We may refuse a request in certain circumstances, in which our justification will be communicated to you.

Right to rectification

You have the right to have any inaccurate personal information that we may hold for you rectified (corrected) and to request that any incomplete information be completed. You can make your request using the contact details above. If we accept that your information should be rectified, we will do so within one month. In certain circumstances, we may refuse a request if we consider the request to be unfounded or excessively repetitive.

Right to erasure

You can request that the information we hold about you be deleted by contacting us using the details above and we will respond within one month. The right to erasure applies if:

• we no longer need your information for the purpose for which we collected it
• our processing of your information is based on consent, and you withdraw that consent
• processing of your information is based on legitimate interests, and you successfully object
• you object to the use of your personal information for direct marketing purposes
• your information has been processed unlawfully
• we have a legal obligation to remove your personal information

In certain circumstances, we may refuse a request for erasure if we consider the request to be unfounded or excessively repetitive, or if any of the specific provisions of the current data protection legislation apply. If we have shared your personal information with any third parties and accept your request for erasure, we will contact them accordingly so they can erase your information as well.

Right to restrict processing

You can make a request for information we hold about you to be suppressed (in other words to be stored but not used) in the following circumstances:

• you have contested the accuracy of the information we hold, and we are investigating
• your information has been unlawfully processed but you want to restrict it, not erase it
• you want us to keep your information after we need it in support of a legal dispute
• you have objected to our processing of your information and we are investigating

You can make your request using the contact details above and we will respond within one month. In certain circumstances, we may refuse a request to restrict processing of your information if we consider the request to be unfounded or excessively repetitive.

Right to data portability

The right to data portability gives you the right to receive the personal information you have provided to us in a structured, commonly used and machine-readable format. It also gives you the right to request that we transfer it directly to another controller. This only applies to information stored electronically, provided directly by you and which we process based on your consent.

Right to object

You have the right to object to the processing of your personal data in certain circumstances. In the case of direct marketing, this is an absolute right. In other circumstances, we may continue the processing if there is a compelling reason for doing so, or if we consider the request to be unfounded or excessively repetitive. You can make your request using the contact details above and we will respond within one month.

What should you do if you have a complaint?

If you have a complaint concerning Oswestry Town Muesum processing of your personal data, you can contact us using the information above. Data Protection legislation also gives you the right to lodge a complaint with a supervisory authority. More information can be found on the Information Commissioner’s Office website at www.ico.org.uk.