Personal data is information that can be used to help identify an individual, such as name, address, telephone number or email address. This page sets out the details of the Museum’s privacy notice, covering the Foundling Museum and its subsidiary company, in relation to the collection and use of personal information you give us. This notice applies to our website, our use of emails and any other methods we use for collecting information. It covers what we collect and why, what we do with the information, what we don’t do with the information, and what rights you have.
For the purposes of the General Data Protection Regulations (GDPR) we have reviewed our opt-in communication policy. This means that we will only send marketing communications to people who have specifically stated that they are happy for us to do so via their preferred channel.
Our marketing communications includes information about our latest exhibitions, dynamic events programme, campaigns, exciting retail and venue hire offers, plus our learning programme. If you want to receive this information but haven’t opted in, you can do so by visiting our website at foundlingmuseum.org.uk/join-our-mailing-list, call us on 020 7841 3594 or email firstname.lastname@example.org
Who we are
The Foundling Museum
40 Brunswick Square
London WC1N 1AZ
The Foundling Museum is a registered charity in England and Wales (no. 1071167) and company (no. 03621861).
The data controller is the Foundling Museum.
Your acceptance of this notice and our right to change it
By using our website, social media pages, entering a competition or providing your information you consent to our collection and use of the information you provide in the way(s) set out in this notice.
The notice in brief
It’s important that you read the full notice (below) to understand what information we hold, how we may use it, and what your rights are. Here is a summary:
- We collect information that is either personal data (as outlined above) or non-personal data (such as IP addresses, website pages accessed etc)
- We collect information about the people we work with, members, supporters, visitors, volunteers and employees
- We collect information to provide services or goods, to fundraise for our work, for administration, research, profiling and analysis
- We only collect the information that we need or that would be useful to us to develop our work and enable us to provide the best possible experience
- We do our very best to keep personal information secure, including SSL technology (secure server software) wherever we collect personal data online
- We never sell your data and will never share it with a third party for marketing purposes without your consent
- We only share data where we are required by law or where you have given us permission to share it with carefully-selected partners who we work with. All our partners are required by their contract to treat your data as carefully as we would, to only use it as instructed, and to allow us to check that they do this.
Full privacy notice
What information do we collect about you and why?
We will only ever collect information we need, including data that will be useful to help improve our services. We collect two kinds of information:
- Non-personal information such as IP addresses (the location of the computer on the internet), pages accessed and files downloaded. This information helps us to determine how many people use our website, how many people visit on a regular basis, and how popular our pages are. This information doesn’t tell us anything about who you are or where you live. It simply allows us to monitor and improve our service.
- Personal information such as name, postal address, telephone number, email address, date of birth, gender and ethnicity (where appropriate), information about your interests, relationships to other donors/members, biographical information and your relationship with the Museum.
We collect this personal information in connection with specific activities such as newsletter requests, tour and group visit bookings, membership registration, feedback, donations, competitions and employment applications. This may consist of details of:
- ticket purchase and event registration/attendance
- contact preferences
- gift information, including Direct Debit bank details where applicable
- Gift Aid status
- details of correspondence sent to you, or received from you
- donor status and wealth assessment information
- employment information and professional activities
- any other information provided by yourself at the request of the Foundling Museum
The information is either needed to fulfil your requests or to enable us to provide you with a more personalised service. You don’t have to disclose any of this information to browse our website. When we ask you to provide your personal information we will let you know why we are asking, and how we will use your data, by directing you towards this notice. However, if you do choose to withhold requested information, we may not be able to provide you with certain services. If deemed appropriate we may store your personal details on a contacts database. This will be for contractual purposes or mutual legitimate interest.
What we do with your information
Depending on your relationship with the Foundling Museum, and the preferences you have indicated, we will use information you provide to:
- fulfil requests such as applications for membership, donations, competition entries and participation in campaigns
- process sales transactions, ticket and tour bookings or other payments, and verify financial transactions
- handle orders, deliver products and communicate with you about orders
- communicate with you about tour, group and school visit bookings
- process donations you make, along with correspondence regarding these and potential donations
- send e-newsletter subscribers and members promotional, marketing or fundraising information by post or electronic means (as applicable). These types of communications can include:
- Informing you of products, services or events related to the Foundling Museum, such as exhibitions, events, or retail offers
- News and updates about the Foundling Museum, such as What’s On guides, and marketing or supporter e-newsletters
- Information on our fundraising operations, including occasional targeted requests to consider giving financial support to the Foundling Museum, or to ask you to consider supporting us in other ways
- Other relevant communications based upon your relationship with the Foundling Museum
- send you press releases and information about relevant events which may be of interest for press coverage purposes
- check if we have accurate contact details for you – see ‘How we update, screen and analyse your information’for further information
- carry out research to help us understand our members, donors and potential donors, including gathering information from publicly available resources to give an insight into your philanthropic interests and ability to support the Foundling Museum. See ‘How we update, screen and analyse your information’for further information
- carry out research on the demographics, interests and behaviours of our users and supporters to help us gain a better understanding of them and to enable us to improve our service. This research may be carried out internally by our employees or we may ask another company to do this work for us
- invite you to events such as exhibition openings or fundraising receptions
- organise volunteering activity you have told us you want to be involved in
- process venue hire contracts
- process employment applications
- monitor the effectiveness of our communications with you, including email tracking, which records when an e-newsletter from us is opened and/or how many links are clicked within the message. The data from this tracking is generally used in an aggregated and anonymised form
- analyse the operation of our website and your interaction with our website/social media channels to improve these and their effectiveness
You can opt out of any / all of our communications at any point simply by contacting email@example.com.
There are some membership and donation communications that we are required to send regardless of your contact preferences. These are essential communications, deemed necessary to fulfil our contractual obligations to you. These include Direct Debit confirmations and advanced notices, thank you letters, member benefits such as Friends/Patrons e-newsletters and membership cards, renewal reminders, Gift Aid confirmation letters, and querying returned mail or bounced Direct Debit payments with you.
How we update, screen and analyse your information
We continuously review records of supporters to ensure your data is as accurate as possible. We may consult alternative sources in order undertake these checks, such as:
- Reviewing employment information that you have made publicly available via social media
- Newspaper articles, publications and company websites
- Companies House and other company information databases
- Charity Commission
- Any other publicly available sources
You can opt-out of your data being utilised for wealth screening, data cleaning or analysis (with the aims of targeting communications with you appropriately, or finding up to date contact information in the case of gone away mail) simply by contacting firstname.lastname@example.org.
Sharing your information
We will not disclose personal data to any third parties or external organisations without consent unless:
- we are legally required to do so (eg. by a law enforcement agency legitimately exercising a power or if compelled by an order of the Court)
- we believe it is necessary to protect or defend our rights, property or the personal safety of our employees or visitors to our premises, website or social media channels
- we are working with a carefully-selected partner that is carrying out work on our behalf. These partners may include marketing agencies, IT specialists and research firms. The kind of work we may ask them to do includes bulk e-mailing Museum newsletters, carrying out research or analysis, and processing card payments. We only choose partners we can trust, who treat your information as carefully as we would and who only use the information for the purposes it was supplied
Your data will never be sold or passed to any third party for any other purpose.
How we keep your information secure
We place great important on the security of all personally identifiable information associated with our supporters, customers and users. We have implemented security procedures, rules and technical measures to protect the personal data that we have under our control.
We use secure server software to encrypt personal information you input into our website. While we cannot ensure or guarantee that loss, misuse or alteration of data will not occur while it is under our control, we use our best efforts to try to prevent this.
All our employees and data processors who have access to and are associated with the processing of personal data, are legally obliged to respect the confidentiality of our visitors’ and supporters’ personal data. If your data has to be shared with a third party for the purpose of an event, we will let you know when you register.
Any third parties who handle personal data, such as processing payments, are selected with care. We provide these third parties with the information that is necessary to provide the service and will ensure they operate with the same care over data protection as we do.
Information is stored by us on computers located in the UK. Our server is kept secure and all computers and relevant software is password protected.
Our contacts database is run by Access Group which is ISO 27001 accredited. All data is SSL encrypted and G-Cloud 7 certified. Each of their data centres are located in the UK.
How long we keep your information for
We will keep your information only for as long we as need it to provide you with the goods, services or information you have requested, to administer your relationship with us, to inform our research into the preferences of our supporters, to comply with the law, or to ensure we do not communicate with people who have asked us not to. When we no longer need information we will always dispose of it securely.
How can I access the information about me?
You can ask us if we are keeping any personal data about you and you can also request to receive a copy of that personal data – this is called a Subject Access Request.
To make a Subject Access Request you will need to provide adequate proof of identity such as a copy of your passport, birth certificate or driving licence before your request can be processed. In line with GDPR, a reasonable fee may be charged to cover the administrative costs of providing the information if the request is unfounded, excessive or repetitive.
Please try to be as clear as possible about the information you are seeking.
Once we have received your Subject Access Request, the agreed fee (if applicable) and proof of identity, you will receive a response from us within one month and you will be able to get copies of any information we hold on you. However, exemptions to disclosure may apply in some circumstances.
Subject Access Requests should be sent to:
Data Protection Officer
The Foundling Museum
40 Brunswick Square
London WC1N 1AZ
At any time you may request that we delete or correct your personal information. If you wish to correct any information on you held by the Foundling Museum, simply contact email@example.com.
If you are signed up to our e-newsletters, you can easily unsubscribe at any time by clicking the ‘Unsubscribe’ link at the bottom of the email or emailing firstname.lastname@example.org.
Changes to our privacy notice
We regularly review our privacy notice, and may make changes time to time. Any changes made will be posted to this page, and will apply from the time we post them. This privacy notice was last changed on May 2018.
How to contact us
If you have any comments on our privacy notice, or information we hold about you, please contact us:
- by email at email@example.com
- or write to us at The Foundling Museum, 40 Brunswick Square, London WC1N 1AZ
Other important information
Links to third party websites
Social media sites
Other people’s data
Some of the services we offer allow you to provide the personal data of other people (eg. tagging people on Facebook). Before providing anyone else’s data please ensure they are happy for you to do so and under no circumstances must you make public another person’s personal information such as email address, telephone number or postal address.
In order to make the Foundling Museum’s website easier to use and improve our service, we sometimes place small amounts of information on your computer. These are known as cookies and they are used by most major websites.
What are cookies and how do we use them?
Cookies are small text files that are placed on your computer by websites that you visit. We use information supplied by cookies to help understand the number of people who use our website. We collate information relating to users’ activity and experience on the site via Google Analytics. This helps us measure our website’s effectiveness, improve its performance, and report statistics to funders and project partners. The cookies collect information in an anonymous form and are completely safe and secure. For more information on cookies visit www.aboutcookies.org
Do I have to agree to cookies?
Under the new GDPR legislation, information provided by cookies is considered personal data. We are therefore required to ask you to opt-in to accept cookies when browsing our website. When landing on our website for the first time cookies will be blocked until you accept them via the notice that appears at the bottom of the page.
You don’t have to accept the cookies, however by doing so you will be providing us with vital information to improve the user experience of our website and to analyse its effectiveness.
How do I delete cookies?
If you wish to restrict or block the cookies which are set by the Foundling Museum website, or indeed any other website, you can do this by visiting www.aboutcookies.org which contains comprehensive information on how to do this on a wide variety of browsers. You will also find details on how to delete cookies from your computer, as well as more general information about cookies.
The information below shows cookies that are set by this website. If you have any queries about these cookies, please contact us at firstname.lastname@example.org
Measuring website usage (Google Analytics)
We use Google Analytics on an ongoing basis to collect information about how people use the website. We do this to make sure we are meeting our users’ needs and to understand how we can improve the site.
Google Analytics stores information about what pages you visit, how you got there and what you click on. We do not collect or store any personal information (eg. your name or address). We do not allow Google to share our analytics data.
We use Google Analytics Demographics and Interest Reporting to more accurately determine visitors by age, gender and interests. This helps us better establish the types of content we make available and what we produce online is relevant to our audiences.
You can opt out of Google Analytics by implementing the Google Analytics Opt-out Browser Add-on.
|_ga||2 years||Used to distinguish users.|
|_gid||24 hours||Used to distinguish users.|
|_gat||1 minute||Used to throttle request rate. If Google Analytics is deployed via Google Tag Manager, this cookie will be named _dc_gtm_.|
|AMP_TOKEN||30 seconds to 1 year||Contains a token that can be used to retrieve a Client ID from AMP Client ID service. Other possible values indicate opt-out, inflight request or an error retrieving a Client ID from AMP Client ID service.|
|_gac_||90 days||Contains campaign related information for the user. If you have linked your Google Analytics and AdWords accounts, AdWords website conversion tags will read this cookie unless you opt-out.|
|__utmt||10 minutes||Used to throttle request rate.|
|__utmc||End of browser session||Not used in ga.js. Set for interoperability with urchin.js. Historically, this cookie operated in conjunction with the __utmb cookie to determine whether the user was in a new session/visit.|
|__utmv||2 years from set/update||Used to store visitor-level custom variable data. This cookie is created when a developer uses the _setCustomVar method with a visitor level custom variable. This cookie was also used for the deprecated _setVar method. The cookie is updated every time data is sent to Google Analytics.|