Introduction

The purpose of this privacy notice is to help you understand why Oriel Môn asks for your personal data, how we use the data, our obligations under the law and your rights.

Your data will be processed according to obligations laid out in the General Data Protection Regulation (EU) 2016/679, the Data Protection Act 2018 and the Privacy and Electronic Communications (EC Directive) Regulations 2003.

If you have any questions or concerns about our privacy notice, or how Oriel Môn uses your data, please contact:

Senior Manager, Oriel Môn, Rhosmeirch, Llangefni, Anglesey LL77 7TQ
orielynysmon@ynysmon.llyw.cymru
01248 7244 44

Oriel Môn is a department within Lifelong Learning, Department for Education, Skills and Young People, Isle of Anglesey County Council.

Isle of Anglesey County Council (Council) is the data controller for your information. This means that the Council protects your information and decides on how it is used. The legal term for using information is processing. Also, the legal term for information about you is 'personal data'.

If you have any questions or concerns about our privacy notice you can contact the Council Data Protection Officer:

Corporate Information Governance Manager and Data Protection Officer

DPO@anglesey.gov.wales

We hope that our data protection officer can resolve any query or concern you may raise about our use of your personal information.

Information

Who we are we

Oriel Môn is a museum and art gallery on Anglesey. Oriel Môn plays a critical role in the visuals arts and heritage of north Wales, delivering a high quality professional programme of artistic and heritage related exhibitions and events.

Oriel Môn cares for art and artefacts in trust for the public and delivers a community outreach and educational programme and supports up and coming artists and makers. Oriel Môn champions the Welsh language and is a hub for the communities of Anglesey.

How we use your personal data

Your data is important to us. The information you provide will only be processed in accordance with current legislation and this privacy notice. How we use your data depends on your relationship with Oriel Môn, Isle of Anglesey County Council. The information will not be used for purposes that are not compatible with why it is gathered in the first instance.

Oriel Môn collects and uses your personal information because it has a legal duty or right to do so; or to perform a public interest task; or because you have given your consent; or for legitimate business interests. The legal term for this is called 'legal basis of processing'.

The legal basis for processing your information

Oriel Môn collects and uses your personal information because it has a legal duty or right to do so (contract); or because you have given your consent; or for legitimate business interests. The legal term for this is called 'legal basis of processing'.

Contract

Oriel Môn is using your personal information because it may be a contractual requirement. Failure to provide the required information will result in the services requested by yourself being ceased/not provided.

Examples

• Transferring ownership of art and/or artefacts into Oriel Môn’s collection.
• Transferring copyright of art and/or artefacts to Oriel Môn.
• Administering a loan of art and/or artefact.
• Buying art works, products or tickets in our shop and online.
• Booking a ticket for an exhibition or event or hiring a room.
• Making a donation.

Consent

Oriel Môn is using your personal information because you have given your explicit consent to the processing. Please note, that as you have consented to the processing, you have additional rights, which are explained below.

Examples

• Ensuring that you are sent relevant marketing information about exhibitions, events, products and services at Oriel Môn by email, post or by phone. You can tell us how you want to communicate with us, with clear preference categories with an opt-out option when we send you any marketing or fundraising communication.
• To contact you with details on how you may support our work through making a donation or gift.
• To take and use photos of Oriel Môn participants for documentary and marketing purposes.

Please note that the Council will collect and share data with the Auditor General for Wales’ (AGW’s) in connection with his audit work and studies. Data sharing will also take place pursuant to the duty at Section 33 of the Local Government (Wales) Measure 2009.

Legitimate business interests

In this instance, the Council is using your personal information for legitimate business interests. We only do this is there is no overriding prejudice to you by using your personal information in this way.

Examples

• Sending you a visitor or feedback survey by email to help us understand how we can improve the service we provide you with.
• Sharing your data securely with a supplier to undertake direct mailing on our behalf.
• Managing data on secure spreadsheets independent of our EPOS system.
• Using anonymised data to help make our marketing communications more effective.
• Using anonymised data so that we can report to our funders.
• Segmenting your data to ensure you are sent relevant information.
• Using bulk email sending software for our email marketing communications.
• To take photos of our audience in our exhibition and public spaces for use in our marketing and promotional activity.
• Capturing and storing CCTV footage for security and safety purposes.
• To contact schools, colleges, community groups and organisations about relevant exhibitions, events and projects.
• To contact members of the press with invitations to press nights, press releases and story ideas and opportunities.
• To invite funders, stakeholders and members of the arts, heritage and museum sectors.
• To send funders, stakeholders and public representatives information about new developments at Oriel Môn which are in the public interest.
• To manage relationships with potential funders and donors.
• To contact Ymddiriedolaeth Oriel Môn members with information on exhibitions and events and the latest news by email and by post.
• To manage the running of educational and community programmes and any other classes, workshops and projects which includes contacting parents/guardians if there are changes to sessions etc.

What information we collect and retain

The information you provide us with is retained and used for administration, advertising, marketing and fundraising purposes. You will be asked for personal information and we will retain your name, signature, address and contact details when you loan or donate art and/or artefacts to Oriel Môn. These are stored as paper records or on spreadsheets which are locked and restricted to particular personnel.

You will be asked for personal information and we will retain your name, contact details and contact preferences when you make a purchase tickets – and these will be recorded on our CRM module of our CRM system (Haven) and IOACC’s CRM system. We will be sharing this data with the Welsh Government’s ‘Track, Trace and Protect’ scheme. They have the right to this information for a period of 21 days following your visit.

When you purchase products from our shop, these are recorded on our CRM module of our EPOS system (Haven).

When you purchase products online, your details are recorded by Shopify and Worldpay.

We will record your details when you make a donation, join as a member of the Trust or loyalty scheme, or join our mailing list.

Where you make a donation, we will keep a record of the details of the gift (amount and date) and your Gift Aid status. These are stored on spreadsheets that are encrypted and/or password protected. All of our staff received PCIDSS and corporate data protection training.

When using our website, we will use cookies to enable online transactions, to understand how people use our website and to inform our digital advertising.

We will keep a record of your bank or credit card details used to make the purchase, but only temporarily and solely to process your transaction, including online. We comply fully with PCIDSS security guidelines and policies.

We will store information which will include some of the following:

• Full names and titles.
• Postal address.
• Email address.
• Telephone number (landline and mobile).
• Name of a child (if booking workshop place by parent or guardian,including family events, workshops, Clwb Celf, Criw Celf, Portffolio, Raising the bar, volunteering placements).
• Access requirements.
• Contact preferences and interests.
• Payment card details.
• Gift aid/tax status.
• Information collected through surveys and questionnaires.
• Information collected through cookies.

Who we share your information with

The data which Oriel Môn holds about you is disclosed to the following categories of third party service providers who perform functions on our behalf. We require that our third party service providers only use your personal data as necessary to provide the requested services to us and each service provider is subject to a set of terms consistent with this privacy notice, and the law. They include:

• Ymddiriedolaeth Oriel Môn Trust
• hosting providers for the secure storage and transmission of your data
• identity management providers for authentication purposes
• database software providers for the management and tracking of your data
• legal and compliance consultants such as external counsel, auditors or tax consultants
• marketing providers who send communications on our behalf
• payment solution providers for the secure processing of payments you provide to us

In these cases, we require that these third parties comply strictly with our instructions and with data protection laws, for example security of personal data. We do not share data with other companies.

We may share your data where we are under a duty to disclose your personal information to comply with any legal or working obligation, for example local or national government bodies and law enforcement agencies. These may include MALD and Arts Council Wales/Welsh Government, Welsh European Funding Office (WEFO), other Isle of Anglesey County Council Services, Isle of Anglesey Charitable Trust, other Local Authorities and funding bodies. Your information will only be shared for the purpose it is intended.

How long we keep information

The information you supply will be kept for as long as is required or necessary in accordance with our Retention Schedule, and will be destroyed securely. The retention periods are set out in Oriel Môn’s list of retention periods, known as a retention schedule. If you wish to view a copy of our Retention Schedule please contact the Data Protection Officer on DPO@anglesey.gov.wales. The option to unsubscribe from our mailing list e-newsletters is available on all newsletters.

Keeping information up to date

We would really appreciate it if you could let us know if your contact details change.

What are your rights

You have legal rights, and it is important that you know what they are.

You have the right to obtain confirmation that information about you is being used

The Council will provide confirmation if you ask for it.

You have the right to obtain a copy of your personal data

You will be provided with copies of your personal data within the statutory period of one month (or if providing your personal data is a complex matter, this will be done as soon as is reasonable within 3 months). Your personal data will be provided to you free of charge, however, if your request is deemed manifestly unfounded or excessive, a reasonable fee will be charged. You ask to obtain your personal data by contacting the Council’s Data Protection Officer.

You have the right to have information about you corrected. This is known as the right of rectification

You have the right to ask that your personal data is rectified if it is incorrect or incomplete. This will be done within 1 month, or if your request is complex, within 3 months.

The right to have personal data erased

You have a right to have personal data erased in specific circumstances:

• Where the personal data is no longer necessary in relation to the purpose for which it was originally collected/processed;
• If you withdraw your consent;
• When you object to the Council’s processing and there is no overriding legitimate interest for continuing the processing;
• If the personal data was unlawfully processed;
• When the personal data has to be erased in order to comply with a legal obligation; or
• When the personal data is processed in relation to the offer of information society services to a child, for example an “app” developed specifically for children.

The right to restrict processing

Where it is claimed that data is inaccurate or the right to erasure has been exercised you can require the Council to restrict processing until verification checks have been completed.

The right to data portability

Under certain circumstances, you have the right to obtain and reuse your personal data across different circumstances. You should contact the Council’s Data Protection Officer if you feel this right applies to you.

The right to object

In addition to the right to object to your information being used for direct marketing, you have the right to object to processing based on the performance of a task in the public interest/exercise of official authority (including profiling), and processing for purposes of scientific/historical research and statistics.

The right to withdraw your consent at any time

This means that if the Council uses your consent to process your personal data, you can withdraw it by calling or emailing Oriel Mon or unsubscribing from an e-newsletter. This does not change the lawfulness of processing that happens before you withdraw consent.

Rights in relation to automated decision making

You have the right not to be subject to decisions based solely on automated processing including profiling, which produces legal effects on you or affects you in a significant way.

Changes to this privacy notice

Our Privacy Notice may change from time to time, so you may wish to check it each time you visit our website. Any changes will apply from the time that they are posted on the website. If we make significant changes in the way that we treat your personal information we will make this clear on our website and/or by contacting you directly.

Complaint/security breach

The General Data Protection Regulation also gives you the right to lodge a complaint with a supervisory authority where you work, normally live or where any alleged infringement of data protection laws occurred.

In the event of a breach of security leading to the accidental or unlawful destruction, loss, unauthorised disclosure of, or access to, personal data, Oriel Môn will promptly assess the risk to people’s rights and freedoms and if appropriate report this breach to the Information Commissioner’s Office.

The supervisory authority in the UK is the Information Commissioner who may be contacted at https://ico.org.uk/concerns

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF

Email: casework@ico.gsi.gov.uk

Telephone: 0303 123 1113

_{Published on 20 November 2019}