Welcome to York Museums Trust’s privacy notice. We are committed to the protection of your privacy and your rights.
As a Registered Charity, we value and respect our visitors, volunteers, donors and supporters who make our work possible, preserving the buildings and collections entrusted to us for future generations.
The aim of this document is to share how we collect, store and use the personal information you give to us. We want to ensure that you stay informed and are confident about giving us your information.
As a data controller we comply with the General Data Protection Regulation (GDPR), the Privacy and Electronic Communications (EC Directive) Regulations 2003 and other relevant legislation. We are registered with the Information Commissioner.
You can contact our Data Protection Officer via:
Data Protection Officer
York Museums Trust
St Mary’s Lodge
• To be clear about why we need to record your personal information and what we would like to use it for
• To never share or sell your personal information
• To make sure that our suppliers and partners who undertake work for York Museums Trust meet the same high standards that we hold when handling your personal information
• To ensure your personal data is up to date, safe and secure at all times
• To make it easy for you to let us know how you would like us to keep in touch
What personal data do we collect?
We collect personal data (any information which identifies you, or can be identified as relating to you personally) that helps us to deliver and improve our services. This includes:
• Name and address
• Email address and telephone numbers
• Date of birth
• Payment information such as credit card and bank details
• York Museums Trust sites that you have visited
• Details of purchases, YMT Card Membership, Gift Aid Declarations, donations and gifts in your Will
• Photograph (for YMT Card Membership)
• Details of job applications and volunteering
• How you would like to hear from us
• Other information you may give us including gender, employment status, demographic information, CCTV images, opinions and attitudes about YMT – if for example taking part in focus groups or exit surveys
We collect this information when you share it with us directly, for example gift aid details and YMT card information on our admissions desk.
When you visit our website we collect standard technical information including the internet protocol (IP) address used to connect your device to the internet. We also collect information about your visit to the websites.
We also collect and use your personal information by using cookies on our website – please see our cookie notice (create link)
Sensitive personal data
Sometimes we may collect sensitive personal data for Equal Opportunities and Diversity monitoring, as well as for researching whether we are delivering excellent experiences for everyone.
We do not collect the personal data of children.
What do we do with your information?
We will use your information to make sure that you receive the product or service that you have requested, process authorised payments and send you information relating to that service.
If you have joined as a YMT Card Member this will include sending you confirmation of your membership, membership materials including the member’s Handbook, information on how to use your membership, and regular email newsletters. We will also send you information about membership renewal and information relating to Direct Debit payments. Please see the Membership section of our website or your Handbook for more information, or contact:
The YMT Card Holders’ Office
York Castle Museum
Eye of York
If you have made a donation, this will include thanking you for your support and letting you know how your gift has helped us
Please let us know if your details have changed.
Marketing and Communications
You can choose how you would like to receive information from us and you can change your mind at any time; we will keep your preferences up to date.
We want to make sure that we are not sending you too many marketing communications. We will send you no more than 12 a year, in addition to communications that are not marketing related such as Membership information.
Every e-communication we send you will have a link for you to unsubscribe if you no longer wish to hear from us in that way. If you choose not to receive marketing communications from us then you may not hear about events or other work that we do that may be of interest to you.
What is the purpose and legal basis of the processing?
Data Protection Laws require YMT to meet certain conditions before we are allowed to use your personal data. We consider the following to be relevant:
• Where you have provided your consent for us to use your personal information in a certain way
• Where necessary so that we can comply with a legal obligation to which we are subject
• Where necessary for the performance of a contract to which you are party
• Where it is your / someone else’s vital interests (e.g. medical emergency)
• Where there is a legitimate interest in us doing so
Who has access to your information?
We will only share your personal information where we are legally required to do so, or we have engaged a supplier or contractor to undertake services on our behalf, such as carrying out research and analysis.
We will never sell your information or let other organisations use it for their own purposes.
We only work with trusted suppliers and contractors who have demonstrated to us that they comply with the General Data Protection Regulation and other relevant legislation.
The accuracy of the information that we hold about you is important to us. If any of the information that we hold is inaccurate or out of date let us know using the contact details below.
You have a number of rights under the Data Protection Laws in relation to the way we process your personal data, namely:
• the right to confirmation as to whether or not we have your personal data and, if we do, to obtain a copy of the personal information we hold (this is known as subject access request);
• the right to have your data erased (though this will not apply where it is necessary for us to continue to use the data for a lawful reason);
• the right to have inaccurate data rectified;
• the right to object to your data being used for marketing or profiling; and
• where technically feasible, you have the right to personal data you have provided to us which we process automatically on the basis of your consent or the performance of a contract. This information will be provided in a common electronic format.
Please keep in mind that there are exceptions to the rights above and, though we will always try to respond to your satisfaction, there may be situations where we are unable to do so.
Where YMT is using your personal data on the basis of your consent, you have the right to withdraw that consent at any time. You also have the right to ask us to stop using your personal data for marketing purposes.
You can change your preferences with us by unsubscribing from e-newsletters, a link can be found at the bottom of each of our communications with you. You can also contact us via:
or call us on (01904) 687687.
Subject Access Requests
If you would like further information on your rights or wish to exercise them in a Subject Access Request, please write to us at:
Data Protection Officer
York Museums Trust
St Mary’s Lodge
Keeping your information safe
The security of your information is very important to us and our networks are regularly monitored to ensure that they remain secure.
We only use and store your information for as long as it is reasonably necessary for the purposes it was collected for. The length of time YMT will keep your information will depend on the information itself, what it is being used for and our statutory legal or taxation requirements.
All our staff receive Data Protection awareness training and we have a dedicated Data Protection Officer. Refresher training is provided at regular intervals to all our teams and bespoke training is provided for staff with specific Data Protection responsibilities.
How do I complain?
If you are not happy with the way your information is being handled, or with the response received from us, you have the right to lodge a complaint with the Information Commissioner’s Office at Wycliffe House, Water Lane, Wilmslow, SK9 5AF (https://ico.org.uk/).