Privacy Policy

Amgueddfa Cymru - National Museum Wales (the Museum) gathers personal information either for purposes directly related to a service, function or activity of the Museum.

The Museum holds this information securely in accordance with current UK legislation. The Museum collects your personal information for the purposes of:

• Museum Management & Administration: for example, recruitment, payroll, pensions, compiling visitor statistics, servicing contracts or maintaining the accuracy of catalogues and directories.
• Research: for example, finding out how we can improve our services, or which parts of our Web site people visit or to add to the knowledge and understanding of the exhibits and collections both of the Museum and of other institutions

For more information about our Website monitoring, our cookies policy can be found here.

• Curatorial: for example, to add to the knowledge and understanding of the exhibits and collections of the Museum
• Promotion: to contact you with information on our exhibitions, events or other activities of the Museum

We will only send you information about our exhibitions, events and activities if you have given us specific, 'opt-in' consent to do so.

If you change your mind at any point and wish to stop receiving emails you can click 'unsubscribe' on any email from us or log into your account to change your preferences directly.

• Feedback and surveys: for example, if you contact us following a visit to the Museum, we may keep a record of that correspondence or if you complete one of our anonymous post-visit surveys
• Security: for example to ensure the safety of the Museum visitors, property, personnel, infrastructure and collections
• Fundraising: for example to communicate with our supporters and benefactors, to administrate our membership scheme or your donation to us

This data may include your name, delivery address, email address, telephone number and debit and/or credit card numbers to fulfil your membership contract with us. We do not retain any of your credit or debit card information. If you sign up to Gift Aid whilst supporting us, we are legally required to obtain your full name and postal address.

• Ticketing & Picture Library: for example to fulfil any orders for services you may wish to use or engage with, including online sales or in person at any of our Museums, and provide additional information to facilitate your visit

This data may include your name, delivery address, email address, telephone number and debit and/or credit card numbers to fulfil your ticketing contract. We do not retain any of your credit or debit card information.

We may also ask you to answer various general questions about yourself including any activities or events that you are interested in so that information and future promotions can be tailored to cover the areas we believe you might be interested in for future reference.

We will only ever collect the information we need. When we ask you to provide your personal information we will let you know why we are asking and how we will use your data, by directing you towards this notice. Personal data and your interactions with us are retained in our secure customer relationship management system and where possible we aim to keep a single record for each customer.

If you have given us permission to contact you with marketing information, we will cease to use that data for analytical or marketing purposes after 7 years of inactivity on your account.  We will continue to retain records on our system for up to 15 years from the last activity for purposes, which form a legitimate interest for our business.

We may on occasion contract with a third party to provide these services but we will never let any third party use your information in any way other than that contracted by ourselves.

Security of your personal data

The Museum is committed to keeping your data secure.

All of our data processors, who have access to and are associated with the processing of personal data, are legally obliged to respect the confidentiality of the personal data that we hold. We will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this privacy policy.

Your Rights

As a data subject, you have a number of rights. You can:

• access and obtain a copy of your data on request;
• ask us to change incorrect or incomplete data;
• ask us to delete or stop processing your data, for example where the data is no longer necessary for the purposes of processing; and
• object to the processing of your data where we are relying on our legitimate interests as the legal ground for processing

As a fundraising organisation, we undertake in-house research and from time to time engage specialist third party agencies to gather information about you from publicly available sources, for example, Companies House, the Electoral Register, company websites, ‘rich lists’, social networks such as Linkedin, political and property registers and news archives. This is to enable us to better tailor our communications and to engage with you in a more personalised way.

We may use our trusted third party prospect research partners to collate and analyse information from these sources to help us understand more about your interests and the level of potential engagement or donation. We may also carry out research using publicly available information to identify individuals who may have an affinity to our cause but with whom we are not already in touch. This may include people connected to our current major supporters, trustees or other lead volunteers.

We conduct this research on the basis of our Legitimate Interest in ensuring that our marketing activity is well targeted, relevant and effective. We only use information that is necessary for our purposes and we do not make automated decisions about you.

We also use publicly available sources to carry out due diligence on donors in line with the charity’s Gift Acceptance Policy and to meet money laundering regulations. This is in accordance with our legal and regulatory obligations.

If you have any questions about your data and how we use it, or would like to access our full Internet Security Policy; please contact our Data Protection Officer via email: dpo@museumwales.ac.uk