Museum Service

In order to comply with the UK General Data Protection Regulation (UK GDPR), where personal data relating to a data subject is collected, Lancashire County Council would like to provide you with the following details.

Identity and contact details of the data controller

  • Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ

Contact details of the data protection officer

  • Our Data Protection Officer is Joanne Winston. You can contact her at dpo@lancashire.gov.uk or Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ

Purposes for processing

The Museum Service provide public access to, and engagement with 6 historic buildings, displaying collections and exhibitions illustrating Lancashire life. The Heritage Learning team delivers award-winning curriculum-based Primary, Secondary, Further Education and Higher Education provision alongside wider heritage and cultural learning, both site-based and as outreach, as well as a range of creative partnership projects. The team also manages a wide-ranging loans scheme with a broad collection of original and replica artefacts for use in schools and other organisations. The Conservation and Collections team comprising conservators, technicians and designers provides specialist support to museums and heritage sites across Lancashire. It offers a paid service to organisations and individuals across the region.

Whenever we use information, we always limit this to only the details that are needed and we ensure that it is used safely and securely. All staff receive training on data protection and information security and information is stored within secure IT systems.

Staff who are authorised to have access to systems or other records have been trained in using those systems and access those records via a user name and password.

You are able to sign up to receive email communications about museums and related council services.

With your consent we collect and process some information about customers, visitors, enquirers, donors and potential donors. We record and store this and some other information to help us to:

  • Maintain accurate records of our collections.
  • Provide requested service, goods or information.
  • Allow us to contact you about events, activities, exhibitions and service updates, for example changes to opening times or other changes you might need to know about to improve or enable your visit. To subscribe please sign up. Subscribing for email communications is optional and you can opt-out at any time by completing the unsubscribe form.
  • Gather feedback about our service.
  • Administer competitions and prize draws.
  • Help us when applying for funding and evaluation of funded projects.
  • Provide information arising from local/family history research where there is a strong connection with the history of the area, the collections displayed in a particular venue or the families related to the venue (living and/or working at the site). This may include personal information (historic or current).
  • Process competitions.
  • Administer our collections e.g. legal requirement (transfer of ownership/title) when an object is donated to the Museum Collections. Please be aware that we may ask for more detailed historical information relating to the object in order to provide the fullest context for the object.
  • Relatives (potentially) in the area of collections or research – i.e. additional information about family members linked to a venue.

Our aim is only to hold information to help us give you the right service at the right time. This data is only recorded when it is appropriate and with your knowledge.

Category of personal data being processed

(a) Personal data (information relating to a living, identifiable individual)
(b) Special category personal data (racial, ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation)

Legal basis for processing personal data

The legal basis for processing your personal data, in accordance with the UK GDPR is:

(a) Consent: the individual has given clear consent for you to process their personal data for a specific purpose.

(e) Public Task: the processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law. You must reference the applicable task/function and its' basis in law if you wish to rely on this basis for processing.

(f) Legitimate interests: the processing is necessary for your legitimate interests or the legitimate interests of a third party, unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests.

The legislation that informs the public task in this instance is as follows,

  • Public Libraries and Museums Act 1964

Legal basis for processing special categories of personal data

The legal basis for processing your special categories of personal data, in accordance with the UK GDPR is:

(a) The data subject has given explicit consent to the processing of this personal data.

(j) Processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes.

Recipients of the data

There are certain circumstances where we are required to share your personal information by law, to safeguard public safety, and in risk of harm or emergency situations. Any information which is shared will only be shared on a need to know basis, with appropriate individuals and only the minimum information for the purpose will be shared.

Data about museum service users may also be used for business planning and research purposes by Museums Services and the County Council Business Intelligence team, to understand demand and to improve our services. This will always be done in a way that does not identify individuals unless that is strictly necessary.

With your consent we may share information with:

  • Partner individuals or organisations including:
    • Other museums for the purposes of exhibition credits for example
    • Other services (such as library or archives service) to facilitate answering enquiries
    • Funding organisations such as National Lottery Heritage Fund
    • Visiting researchers
    • General public if used in exhibition credits
  • Lancashire County Council Digital Services
  • Eventbrite
  • Lancashire County Council Business Intelligence
  • Lorensbergs
  • Bibliotheca
  • Education Software Solutions
  • MailChimp
  • Police
  • Project partners for photography/video recording taken during events. This will always be with your consent via a consent form completed by Lancashire County Council or by a third party.

Information we share

  • Name
  • Address
  • Phone numbers
  • Email address
  • School/college details
  • Financial transactions
  • Event bookings

We do not view or retain any credit or debit card information you may share with a third-party Payment Provider.

Our aim is only to hold information to help us give you the right service at the right time. This data is only recorded when it is appropriate and with your knowledge.

Any transfers to another country

Yes - We will always process as little personal data as is necessary to meet the purpose of the processing activity. We will inform you where your personal and sensitive data will be stored and of the additional safeguards that we have taken to ensure compliance with UK GDPR and data protection legislation which applies within the country where your personal and sensitive information is held, should this be outside of the UK.

Retention periods 

Lancashire County Council will only store your information for as long as is legally required or in situations where there is no legal retention period they will follow established best practice.

File type Description  Security Retention period
Email Emails held in Outlook that haven't been exported or moved elsewhere Encrypted email used when emailing personal data to partners. Retained in accordance with appropriate internal retention guidelines
Conservation and collections records Records relating to the collections, conservation, de-accessioning and disposal, loans, donations, bequests. Password protected systems Permanent
Financial transaction details Details of provision of paid services to individuals, organisations and schools. Password protected systems Retained for 7 years from conclusion of financial transaction
User interactions with Museum Services Users contact Museum Services through various means including feedback, queries, compliments, complaints, visitor books, booking for events and facilities. Password protected systems Retained in line with legal requirements and established best practice. Please contact the Museum Service for details of specific retention periods.
Administration records Details in office diaries of bookings, appointments. Hard copy in secure filing cabinets.   Retained for a maximum of 5 years
Photographs, images, voice and video recordings Hard copy or digital records Password protected systems.

Hard copy in secure filing cabinets.		 Retained in line with consented agreement, with consent resought as necessary

Your rights

You have certain rights under the UK General Data Protection Regulation (UK GDPR), these are the right:

  • to be informed via Privacy Notices such as this.
  • to withdraw your consent. If we are relying on your consent to process your data then you can remove this at any point.
  • of access to any personal information the council holds about yourself. To request a copy of this information you must make a subject access request in writing. You are entitled to receive a copy of your personal data within 1 calendar month of our receipt of your subject access request. If your request is complex then we can extend this period by a further two months, if we need to do this we will contact you. You can request a subject access request, either via a letter or via an email to Information Governance Team, address below.
  • of rectification, we must correct inaccurate or incomplete data within one month.
  • to erasure. You have the right to have your personal data erased and to prevent processing unless we have a legal obligation to process your personal information.
  • to restrict processing. You have the right to suppress processing. We can retain just enough information about you to ensure that the restriction is respected in future.
  • to data portability. We can provide you with your personal data in a structured, commonly used, machine readable form when asked.
  • to object. You can object to your personal data being used for profiling, direct marketing or research purposes.
  • in relation to automated decision making and profiling, to reduce the risk that a potentially damaging decision is taken without human intervention.

If you want to exercise any of these rights then you can do so by contacting:

Information Governance Team
Lancashire County Council
PO Box 78
County Hall
Preston
PR1 8XJ 

Or email: dpo@lancashire.gov.uk

To ensure that we can deal with your request as efficiently as possible you will need to include your current name and address, proof of identity (a copy of your driving licence, passport or two different utility bills that display your name and address), as much detail as possible regarding your request so that we can identify any information we may hold about you, this may include your previous name and address, date of birth and what council service you were involved with.

Further information

If you would like more information about this specific service then please contact the Museum Service at museums.enquiries@lancashire.gov.uk.

For more information about how we use personal information see Lancashire County Council's full privacy notice.

If you wish to raise a complaint on how we have handled your personal data, you can contact the Information Governance team who will investigate the matter.

Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ or email: dataprotection@lancashire.gov.uk

If you are not satisfied with our response or believe we are processing your personal data not in accordance with the law you can complain to the Information Commissioner’s Office (ICO). 

} }