Privacy notice for East Riding Museums Service 

What do we use the information for?

East Riding of Yorkshire Museums Service (ERYMS) collects, processes and holds your personal information in order to provide our services effectively. 

• To present our local cultural heritage and engage people with the visual arts.
• To interpret collections, research the wider heritage of the East Riding and facilitate access to a broad cultural experience through exhibition events and learning programmes.

We also use information to improve our services so that they are more appropriate to people’s requirements.  We recognise that your personal information is important to you, and we take our responsibilities for ensuring that we collect and manage it proportionately, correctly and safely very seriously.

What information do we hold and use?

We collect and process the following information:

• Personal information (including full name, full residential address, date of birth)
• Photographic images and film (for marketing)
• Contact details (including email address and contact telephone number)
• Information relating to your enquiry in order to help us respond to you effectively.

On what grounds do we use the information?

ERYMS is an accredited museum service under the Arts Council England’s accreditation scheme. Preservation of key information relating to collections, including details of donors is part of the accreditation standard that ERYMS must adhere to in order to retain its accredited status. Retention of key information also enables future collections research and ensures collections can be properly accounted for in case of audits.

We process personal data for the following reasons:

• GDPR Article 6(1)(a) – the data subject has given consent to the processing of his or her personal data for one or more specific purposes 
• GDPR Article 6(1)(b) – processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract 
• GDPR Article 6(1)(c) – processing is necessary for compliance with a legal obligation to which the East Riding of Yorkshire Council is subject
• GDPR Article 6(1)(e) – processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the East Riding of Yorkshire Council.

How do we collect this information?

Depending on how you contact us, we may collect information in the following ways:

• Telephone
• Email
• Paper, electronic or online forms
• Letter
• Face to face, with one of our employees, or one of our partners. 

Additionally, all donations/ purchases/ loans of artefacts to the ERYMS are documented on Museum Artefact Record forms. Relevant correspondence is retained with the forms to create Object History files. Entries on objects are created on the ERYMS’s Mimsy XG Collections Management database.

Who do we share your information with?

We may disclose your information to others, but only where this is necessary either to comply with our legal obligations or as permitted by Data Protection legislation. We may share it with other public service bodies including the police, the Portable Antiquities Scheme, the Humber Museums Partnership and staff of other museum services. 

The reasons why we may share your data with other public bodies are as follows:

• To monitor and improve our performance and delivery of services
• For the prevention and or detection of crime
• Where necessary to protect individuals from the risk of harm or injury
• Where otherwise permitted under the General Data Protection legislation
• Legitimate research enquiries.

How long do we store it and is it secure?

The ERYMS have retention schedules in place to ensure that information is only held for as long as it is needed. We will not keep your information for longer than is required to by law.  Your information will be disposed of in a controlled and secure manner in accordance with the council’s Records Management and Data Quality Policy. The council’s IT security and confidentiality policies ensure that your information is protected, and accessed only by staff directly involved in your request.

For information on how long your information will be held, visit the retention page.

What rights do you have?

The rights that you have depend on the grounds upon which we collected your information. All of the rights you could have are outlined on the data protection rights page. 

In most cases, people will have the following rights relating to the information we have collected:

• The right of access - you are entitled to see the information the service holds about you
• The right to rectification - we will amend information accordingly, if any information that the service holds about you is incorrect
• The right to restrict processing - you may wish to limit how we use your data
• The right to object - in addition to the right to limit the use of your data, you also have a right to object to the use of you data for certain actions
• The right to erasure/to be forgotten - in certain circumstances, you may be able to ask for some of the information we hold to be deleted. The service has determined that all requests to permanently delete a service user record will be dealt with on an individual basis.

To exercise any of your above rights, please visit the data protection rights pages for more information.

Where can I find out more?

If you would like to know more about how the Council uses information, your rights or have a concern about the way we are collecting or using your personal data, we request that you raise your concern with us in the first instance; contact details are available on the general privacy information page. Alternatively, you can the Information Commissioner’s Office (ICO). The ICO is the UK’s independent authority set up to uphold information rights in the public interest and they handle public concerns regarding organisations information rights practices. 

 Information Commissioner’s Office (external website).

When was this privacy notice last updated?

We will continually review and update this privacy notice to reflect changes in our services, feedback from customers, and to comply with any changes in the law.  This privacy notice was last updated on 4 December 2020.