Privacy Policy

Hampshire Cultural Trust Privacy Policy

Introduction

Hampshire Cultural Trust (“HCT”) is committed to protecting and respecting your privacy. This policy (together with any other documents referred to on it) sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by us. Please read the following carefully to understand our practices regarding your personal data and how we will treat it.

The following websites are owned and operated by HCT: 

hampshireculture.org.uk 
historicwinchester.co.uk
878AD.co.uk 
ashcroft.org.uk 
arcwinchester.org.uk 
collections.hampshireculture.org.uk 
cultureoncall.com 
forest-arts.co.uk 
gosportmuseumandgallery.org.uk 
milestonesmuseum.org.uk 
westendcentre.co.uk

Download the 878 AD: Winchester Revealed app privacy policy here.

Information we may collect from you

Below is a list of circumstances in which we process your personal information. For each one we have specified the types of information we process and the legal ground for the processing:

Situation	Types of personal information	Purpose and legal ground for processing
Donors, visitors and customers
When you have donated to us and have included identifying information with your donation.	Name, address, donations history, Gift Aid declaration.	We have a legitimate interest in maintaining a record of our donors. We also have legal obligations to keep certain records of donations, including for the administration of Gift Aid.
You have used our services or have benefited from the Trust’s work.	Name, details of how you have benefited. NB: this information will be anonymised where possible.	We have a legitimate interest in keeping records of how we apply our funding. As a charity, we also have a legal duty to monitor who benefits from our work.
You request information about our goods, services and events, related topics and marketing materials.	Name, contact information, details of your enquiry.	Typically we process this information on the basis of your consent so that we can send you the requested information. We may also have a legitimate interest in keeping a record of your request and information so that we know we’ve responded to you.
You register/enroll for our free events, classes or workshops.	Name, age, contact information, emergency contact information, identified gender.We may also process sensitive information where strictly necessary. This may include medical information and dietary requirements.If you are registering or enrolling another person then we may also require their information. If they are a child then we may also require and keep a record of parental consent.	We have a legitimate interest in processing the information to administer our events, classes and workshops.For sensitive information we have received consent, which may include parental consent.
You purchase goods or services from us, including tickets to attractions or events and use of Hampshire Wardrobe.	Name, contact information and other relevant information.We may also process sensitive information where strictly necessary. This may include medical information, dietary requirements and a person’s identified gender.If you are buying the goods or services on behalf of another person then we may also require their information. If they are a child then we may also require and keep a record of parental consent.	This processing is necessary for us to perform the contract with you.For sensitive information we have received consent, which may include parental consent.
If you visit one of our venues then we may ask for your post code.	Post code.	We use this information to build an anonymous profile of our visitors because we have a legitimate interest in ensuring we target our resources and services in ways which benefit a wide audience.
You agree for us to send you marketing information by SMS and/or email	Your name, age, contact information, marketing preferences.	We send you marketing information based on your consent.
We take photographs, voice recordings or video of you.	Information about your appearance and location (from the photographs/footage), name and age.Where applicable, we keep a record of parental consent which contains the consenting person’s contact information.	We obtain your consent to use photos, voice recordings or video which you feature in for marketing purposes unless we are relying on our legitimate interest of using the photographs, voice recordings and/or video (as applicable) for the promotion of our charitable activities. We will tell you which lawful basis we rely upon in a given situation. For example, by providing you with a consent form or by posting notices around an area where we are taking photographs/video on the basis of our legitimate interest.  In the case of a child or other person who cannot give consent, we obtain parental or guardian consent on their behalf.If you attend a workshop or event which is recorded for reuse or which is livestreamed (we will notify the person making the booking in advance of this fact) then we process your information because we have a legitimate interest in (as applicable):(i) recording the event for future use by HCT for training purposes and to be made available as a digital-only event; and/or(ii) livestreaming this event to people who have registered to watch it remotely.
You provide us with sensitive information about health, dietary requirements, accessibility needs, etc.	Health, dietary and/or accessibility information regarding you or another person.	We process this information based on your explicit consent except if we need to act in case of an emergency where you are unable to give your consent.If you are providing the information on behalf of another person then usually you will be consenting on their behalf because you have parental responsibility.
You provide us with your information in order to enter into a prize draw, competition or to complete a survey.	Name and contact information.	For a prize draw or competition we use that information to perform the contract between us. If you are a child then we may ask for parental consent.For surveys we have a legitimate interest in studying how our customers use our services so that we can develop and grow our operations.
The use of the cookies on our website.	IP address, information about your browser/device and how you interact with our web site.	With the exception of cookies which are essential to the operation of our website, we set cookies based on your consent.
Partners and suppliers
You or your organisation supply, or offer to supply, us with goods or services.	Name, job title, contact information, payment details.	If you provide us with goods or services then we process your information in order to perform the contract between us.If your organisation is providing us with services then we process your information because we have a legitimate interest in using your details to administer the contract between us and your organisation.
Your or your organisation collaborate with HCT on any projects or activities.	Name, job title, contact information.	We process your information because we have a legitimate interest in administering the relationship between you, or your organisation, and us.
Everybody
We operate CCTV at a number of our premises. These areas feature CCTV notices.	Your appearance and location.	We have a legitimate interest in using the captured footage for monitoring for and deterring crime and using the footage to help us resolve complaints and other disputes. Our use of CCTV is clearly signposted.

Information others may share with us about you

We never buy personal data from third parties or trade data with other charities. In some circumstances we might receive information about you from:

• charities and other organisations where we have joint responsibility for managing the information of attendees; and safeguarding services.

Where we store your personal data

The data that we collect from you may be transferred to, and stored at, our servers in the UK. It may also be processed by persons operating in the EEA who work for us or an organisation we have instructed. If we do send your personal data outside the EEA we will take steps to ensure that appropriate measures are taken to protect your information.

How long we keep your information

We keep the personal data processed by us in a live environment for as long as is considered necessary for the purpose(s) for which it was collected.  Where we need to keep copies of your information long-term, it may be securely archived with restricted access.

Disclosure of your information

We may disclose your personal information to third parties where it is necessary to:

• comply with any legal obligation;
• perform a contract between us;
• enforce an agreement between us or to manage a dispute;
• operate our charity, facilities and events in a safe and efficient manner;
• protect the rights, property, or safety of HCT, our staff, visitors or beneficiaries, or any other person; or
• seek advice from our professional advisers.

In the above situations, we may share your personal information with the following categories of people. Where possible, we will anonymise your information before sharing:

• government bodies and our regulators, including the Charity Commission;
• our outsourced service providers, who are contractually bound to protect your information;
• other organisations we work with, including charities and our funders, who are contractually bound to protect your information;
• our trustees, who have contractual duties to protect your information; and
• our professional advisers, such as our solicitors or accountants. Our advisers have professional duties to protect your information,

Your Rights

Under data protection law you have the following rights:

• the right to be informed about what we do with your information. This policy provides you with this information;
• if we are processing your personal information on the basis of your consent then you have the right to withdraw that consent at any time. Consent can be withdrawn by contacting  us using the details set out below;
• the right to access a copy of your information which we hold. This is sometimes called a ‘subject access request’. Additional details on how to exercise this right are set out below;
• the right to prevent us using your information for direct marketing purposes. We will inform you (before collecting your information) if we intend to use your personal information for marketing purposes. You can exercise your right to prevent this processing by leaving unchecked certain boxes on the forms we use to collect your data or by contacting us using the details set out below;
• the right to object to decisions being made about you by automated means. We will inform you if your information is subject to automated processing;
• the right to object to us processing your personal information in certain other situations;
• the right, in certain circumstances, to claim compensation for damages caused by us breaching data protection law; and
• the right, in certain circumstances, to request that we erase, rectify, cease processing and/or delete your information.

Access to information

Under data protection law you can exercise your right of access by making a written request to receive copies of some of the information we hold on you. We may ask for proof of your identity, and/or proof of authority if you are making the request on behalf of someone else, before we supply the information to you. Requests should be sent to us using the contact details set out below.

You do not need to pay a fee to exercise this right unless you are requesting copies of documents you already have, in which case we may charge our reasonable administrative costs. We are also allowed to charge you for our reasonable administrative costs if your request is clearly unfounded or excessive.

In very limited circumstances, data protection law allows us to refuse to comply with your request. If we refuse to comply then we will notify you of that fact.

In certain circumstances, you are entitled to receive the information in a structured, commonly used and machine-readable form.

Cookies

HCT’s website uses cookies to record visits to the website. Please see our Cookies Policy for more information.

Changes to HCT privacy policy

This privacy policy was last updated on 1 November 2023. If we make important changes to this policy then we will draw them to your attention.

Contact

HCT is a charitable company registered in England and Wales with company number 08986225 and registered charity number 1158583.

Questions, comments and requests regarding this privacy policy should be addressed to data@hampshireculturaltrust.org.uk.

We hope that you won’t ever need to, but if you do want to complain about our use of personal data, please send an email with the details of your complaint to data@hampshireculturaltrust.org.uk. We will look into and respond to any complaints we receive.

You also have the right to lodge a complaint with the UK data protection regulator, the Information Commissioner’s Office (“ICO”). For further information on your rights and how to complain to the ICO, please refer to the ICO website https://ico.org.uk/concerns