Museums Worcestershire Privacy Notice

Museums Worcestershire is the joint museum service operated by Worcester City Council and Worcestershire County Council.

We work in partnership to provide museum, cultural and heritage services to the public:

  • The Commandery
  • Worcester City Art Gallery & Museum
  • Worcestershire County Museum
  • Museums Worcestershire Collections Store

Service being provided

  • Administration of ticketing, admissions, memberships and event bookings
  • Delivery of museum, heritage, cultural and learning activities
  • Facilitation and administration of volunteering opportunities and affiliated volunteering programmes and projects
  • Management and preservation of museum collections and associated records
  • Fundraising, donation administration and supporter engagement activities
  • Recognition and acknowledgement of donors and supporters, where individuals have agreed to such recognition

Data Controllers

For the personal data processed to deliver Museums Worcestershire services, Worcester City Council and Worcestershire County Council act as joint data controllers.

This means the councils jointly decide why personal data is collected and how it is used for the service.

Partner Organisations and Charities

Museums Worcestershire also works with partner organisations, including charities that support our work. Depending on the activity, these organisations may act either as joint controllers with us or as independent controllers in their own right. Further information is set out below in relation to fundraising and donations.

Joint Controller Arrangement (Article 26 UK GDPR)

Worcester City Council and Worcestershire County Council have a joint controller arrangement in place under Article 26 UK GDPR.

This arrangement explains how responsibility is shared for compliance with data protection law, privacy information, data security, retention, and the handling of rights requests.

The essence of the joint controller arrangement is available on request. Worcester City Council acts as the primary contact point for requests made under data protection legislation on behalf of the partnership.

Categories of personal data we collect

  • Name
  • Contact details
  • Booking, ticketing and event information
  • Membership
  • Visitor information
  • Donor and supporter information, including donation history and donor recognition preferences
  • Information relating to museum collections, including donors, lenders, creators, owners, researchers and individuals connected to the provenance, acquisition, management or interpretation of collection items.
  • Photographs and video recordings where appropriate
  • Website usage information, including IP address, cookie identifiers, browser information and analytics data

Categories of personal data we collect for volunteers

  • Name
  • Address
  • Contact details
  • Date of birth
  • Financial information for processing expenses payments (where required)
  • Emergency contact details
  • Identification documents (such as passport or driving licence, where required)
  • National Insurance number (where required)
  • Parental consent (where required)

Special Category or Criminal Offence data we collect

  • Equality monitoring (where necessary)
  • Disability or medical information (where necessary to support reasonable adjustments, health and safety, or welfare)
  • Criminal offence data (where volunteering opportunities require suitability checks, including Disclosure and Barring Service (DBS) checks)

How we collect your data

We collect personal data directly from you when you use our services, for example when you visit our sites, attend events, buy tickets or memberships, contact us, sign up for communications, complete surveys, volunteer with us, or donate to support our work.

In some circumstances we may receive information from:

  • Parents or guardians
  • Emergency contacts
  • DBS and safeguarding organisations
  • Fundraising partners and charities
  • Event organisers working on our behalf
  • Donors, lenders, collectors and owners of museum objects
  • Archive, catalogue and provenance records
  • Researchers and partner heritage organisations

Purpose of processing

  • Deliver museum, cultural and heritage services
  • Manage bookings, events, memberships and visitor enquiries
  • Communicate with you about services, activities and events
  • Undertake research, planning and service improvement
  • Promote events and activities where permitted
  • Administer volunteering arrangements and support volunteer safety
  • Process donations and fundraising activity
  • Recognise and acknowledge donors and supporters where appropriate and where consent has been provided
  • Document, manage, research, preserve and interpret museum collections and heritage assets
  • Maintain provenance, ownership, acquisition, loan and donor records relating to collection items
  • Maintain financial, audit and other records
  • Comply with legal and regulatory obligations

Lawful basis for processing personal data

  • Article 6(1)(a) consent, where you have given us clear permission to use your personal data for newsletters and where an individual has agreed to be publicly acknowledged as a donor or supporter.
  • Article 6(1)(b) contract, where processing is necessary to provide a service you have requested, such as admissions, memberships, event bookings or administering a donation you have chosen to make.
  • Article 6(1)(c) legal obligation, where we must process personal data to meet legal or regulatory requirements such as health and safety, safeguarding and equality monitoring
  • Article 6(1)(e) UK GDPR – Public task, where processing is necessary to deliver community engagement, volunteering, collections management and the delivery of public museum services.

Lawful basis for processing special and criminal offence category data

  • Article 9(2)(b) UK GDPR – employment and social protection processing (applied appropriately to volunteers), and/or
  • Article 9(2)(g) UK GDPR, supported by Schedule 1 of the Data Protection Act 2018 (safeguarding and protection of individuals); and
  • Article 10 UK GDPR for criminal offence data.

Data Sharing Between Worcestershire Heritage, Art and Museums and Museums Worcestershire

Personal data may be shared between Worcestershire Heritage, Art and Museums Charity and Museums Worcestershire where this is appropriate and necessary, for example to recognise donations, acknowledge supporters, administer funded projects, manage supporter relationships, or fulfil donor recognition arrangements that an individual has requested or consented to.

Unless we tell you otherwise at the point your data is collected or shared, each organisation will act as an independent controller for the personal data it receives.

Volunteering

We process volunteer information so that we can manage volunteer roles, provide training and support, and help keep volunteers and others safe.

This may include limited health information where it is necessary for risk assessment, support arrangements or to meet our legal obligations.

CCTV

CCTV operates at some Museums Worcestershire sites for the purposes of public safety, crime prevention, site security and protection of collections. Information about CCTV processing is provided in the relevant CCTV Privacy Notice published by Worcestershire County Council or Worcester City Council, depending on the site concerned.

Sharing Your Data

We may share personal data where necessary with the following types of organisations:

Joint Controllers

  • Worcester City Council
  • Worcestershire County Council

Independent Controllers

  • partner charities involved in fundraising activity

Data Processors

  • systems and service providers we use to manage customer, supporter and booking information, such as Salesforce, Ticketsource and Campaign Master

Other recipients

 

  • Research organisations, including where information is anonymised
  • Contractors and suppliers
  • Professional advisers
  • Regulators, law enforcement or other bodies where we are required to do so

We do not sell personal data.

Data Storage and Retention

We keep personal data in line with our retention schedule and only for as long as necessary for the purpose for which it was collected.

  • Marketing information is usually kept until you withdraw consent or unsubscribe
  • Photographs and video recordings are typically kept for up to 5 years, depending on purpose
  • Volunteer records are kept for as long as needed for administration, safety and compliance purposes, typically the duration of volunteering plus 6 years
  • Financial records are typically retained for at least 6 years in line with relevant legal and taxation requirements.
  • Booking and ticketing records – up to 6 years
  • Membership records – duration of membership plus 2 years
  • Customer enquiries – up to 2 years
  • Some records relating to museum collections, acquisitions, donations, provenance and ownership history may be retained permanently as part of the museum’s statutory and professional obligation to maintain an accurate historic record.

We store personal data securely and delete or anonymise it when it is no longer required.

International Transfers

We do not routinely transfer personal data outside the UK. If this happens, we will ensure that appropriate safeguards are in place.

  • UK adequacy regulations
  • approved contractual safeguards

Cookies and Website Data

We use cookies and similar tools, including analytics tools, to help us understand how our website is used and to improve the user experience.

You can manage cookies through your browser settings and any cookie controls made available on our website.

Automated decision making

We do not carry out automated decision-making or profiling in relation to this processing.

Your rights

You have rights under data protection law, including the right to:

  • access your personal information
  • ask us to correct incorrect or incomplete information
  • ask for your information to be deleted (in certain circumstances)
  • restrict how your information is used
  • object to certain uses of your information
  • request your information in a commonly used format (data portability)
  • understand and challenge automated decisions and profiling

We may not always be able to comply with a request where an exemption applies or where we are required to keep information for legal or regulatory reasons.

Individual’s right to withdraw consent at any time

Where we rely on your consent to use personal data, you can withdraw that consent at any time. This will not affect the lawfulness of any processing carried out before consent was withdrawn.

How Requests Are Handled

  • Requests can be made to Museums Worcestershire using the contact details below
  • Worcester City Council administers requests on behalf of the partnership
  • All relevant controllers remain responsible for complying with data protection law

We will respond within one month.

Complaints and further information

If you would like to get in touch with Museums Worcestershire, please contact:

Email:       gallerymuseum@museumsworcestershire.org.uk
Phone:      01905 25371

Address:   Museums Worcestershire
Worcester City Art Gallery and Museum
Foregate Street
Worcester
WR1 1DT

If you have questions or concerns about how your information is used, please contact either Worcester City Council’s Data Protection Officer:

Email: data.protection@worcester.gov.uk
Phone: 01905 722233

Address:   Data Protection Officer
Worcester City Council
The Guildhall
High Street
Worcester
WR1 2EY

Or contact Worcestershire County Council’s Data Protection Officer:

Email: dataprotection@worcestershire.gov.uk
Phone: 01905 765765

If you remain dissatisfied, you have the right to complain to the Information Commissioner’s Office (ICO):

Website: ico.org.uk

Phone: 0303 123 1113

Address: Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF

Changes to this notice

We may update this privacy notice from time to time. The latest version will always be available on our website.

July 2026

Museums Worcestershire