Privacy policy

We are committed to protecting your privacy and will only use the information that we collect about you lawfully. This policy is intended to give you an understanding of how and why we use the personal information you give us and that we receive from others.

We recommend that you read the full policy to understand what information we hold, how we may use it, how we protect it and what your rights are.

Who we are

In this policy whenever you see the words ‘we’, ‘us’ or ‘our’ it refers to Historic England and Historic England (Shrewsbury Flaxmill Maltings) Ltd. 

The Historic Buildings and Monuments Commission for England is recorded on the ICO Data Protection Register under registration number Z5315038.

Historic England (Shrewsbury Flaxmill Maltings) Ltd is a subsidiary organisation of Historic England and is registered as a company (no. 13975338)

Historic England (Shrewsbury Flaxmill Maltings) Ltd is recorded on the ICO Data Protection Register under registration number ZB343683.

If you have any questions about our use of your personal information, or wish to exercise your GDPR rights, contact us at:

Information Governance Manager

Historic England

Firefly Avenue

Swindon

Wiltshire

SN2 2EH

Email: [email protected]

You can find out more in the Historic England privacy policy here. 

What information we process about you and why

1. When you purchase a ticket or other services online

We collect personal details about you when you purchase tickets to visit or other products or services (including making a donation or Name a Brick).  This includes contact details such as name, telephone number and email address, billing address, donation and gift aid details (if you donate to us), ticketing information such as date of purchase, date of visit, number and type of tickets and purchase history.

We use this information to make sure you receive the service or information you have requested or bought.  We will retain this information for purposes of providing the relevant service and for our accounts and tax reasons.

We use a processor See Tickets to provide ticketing services. See Tickets have access to your personal information solely for the purpose of processing ticketing bookings. They will not use this information for any other purpose. If you consent to receiving communications from See Tickets they will receive your email address and they will be the data controller for this processing.

2. When you use our website

On some parts of our website we will automatically capture your Internet Protocol (IP) address.

This means our systems may keep a record of the online location you are using to access our online services. This is usually anonymised and we cannot identify you from the information alone.

Other information may also be collected about you depending on the choice you make about the use of cookies when you first visited our website. See our cookie policy to learn more. Most of this information is used to make our website work, to keep it secure, and to comply with the law. We may also use it to study how visitors use our website and make use of our other services so we can improve them.

If you contact us, for example, to enquire about the venue, express interest in a service or using our Contact Page, we may ask for your name, email address and telephone number. We will use this information to respond to you.

When you purchase tickets and fundraising services you will be transferred to the Shrewsbury Flaxmill Maltings See Tickets web site which has a separate cookie policy.

3. When you sign up for our email updates

When subscribing to our email updates, we ask for your email address to allow us to send you the email.  We also ask for your first name and surname to allow us to personalise your update and postcode to allow us to analyse our visitor data and this is always done anonymously. This data is used to send you our email updates which will tell you all about Shrewsbury Flaxmill Maltings news, visiting us, events, offers, fundraising, research surveys and opportunities to join our team. 

You can unsubscribe at any time, using the ‘unsubscribe’ link within each email or by contacting us at [email protected] .

We will keep your information until you unsubscribe. If you unsubscribe from emails, your email address will be suppressed to ensure you are not contacted again in future and the data will strictly not be used for any other purpose, to comply with PECR.   

4. When you work for us

If you work for us, or apply for a job with us, we will process your personal data, including sensitive personal data, to comply with our contractual, statutory and management obligations and responsibilities.

5. When you volunteer for us

If you are a volunteer, or apply to volunteer with us, we will collect information (such as contact details, details of emergency contacts and medical conditions).  We need this information for the performance of your volunteering and to comply with legal obligations. We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting or reporting requirements.

If you are volunteering for a role which involves financial responsibility or working with young or vulnerable people, we may undertake additional checks for safeguarding purposes and to protect us in the event of a legal claim.

6. When you visit our site

Our site is protected by CCTV.  You may be recorded when you visit. We use CCTV to help provide a safe environment for our visitors, volunteers and staff, to help protect and detect crime. CCTV is retained for 30 days (unless it is required to be retained for longer to support incident investigation). The systems will only be viewed when necessary.  We use signs to notify people that they are in an area where CCTV surveillance is being carried out.

The legal basis for processing your personal data

We only use your personal data when the lawful allows us to.  We most commonly use your personal data:

For the purpose of performing a contract

Where we need to process data to perform the contract we have entered into with you, or in order to take any pre-contract steps at your request and/or to perform our contractual obligations to you.  This includes providing the service or information you expect from us and contractual obligations relation to employment and volunteering.

Legitimate interests

For our own legitimate interests (or those of a third party). providing your rights don’t override these interests.  This includes defining types of customers for our marketing strategy, keeping our website up to date and relevant, running and administering the site, including providing a safe environment for our visitors, volunteers and staff.

Consent

Where you have given us consent to keep you informed about Shrewsbury Flaxmill Maltings news, visiting us, events, offers, fundraising, research surveys and opportunities to join our team.

Legal Responsibility

Where we need to process data to comply with a common law or statutory duty.  For example, providing tax and gift aid information to HMRC.  To carry out our obligations in employment and social security law.

Sharing your information

Historic England and Historic England (Shrewsbury Flaxmill Maltings) Ltd are the data controllers for the data you provide to us.  Your data will only be processed by employees of these organisations who need access to it to do their jobs.   

Information is only shared when we are required to by law, to exercise or defend our legal rights or with carefully selected partners who work for us.  We will never sell your personal data and we will never share it with another organisation for marketing purposes without your consent.

How long we keep your personal data

We will keep your personal data for no longer than is necessary for the purposes for which it is processed, in accordance with our internal policies. How long personal information will be stored depends on the information in question and what it is being used for.

Storage

The personal data we collect from you may be transferred to, shared and/or otherwise processed by organisations or companies outside the UK.

Where your personal data is transferred outside the UK, we will take reasonable steps to ensure that the recipient implements appropriate measures to protect your personal data.

Your rights

We want to ensure you remain in control of your personal data. Part of this is making sure you understand your legal rights, which are as follows:

• The right of access to a copy of the information we hold about you (this is known as a subject access request);
• The right to have your data erased (though this will not apply where it is necessary for us to continue to use the data for a lawful reason e.g. HMRC and Gift Aid auditing);
• The right to request that we correct any personal data if it is found to be inaccurate or out of date;
• The right to object to your data being used for marketing or profiling;
• Where technically feasible, you have the right to personal data you have provided to us which we process automatically on the basis of your consent or the performance of a contract (known as data portability). The information will be provided in a common electronic format.

Please bear in mind that there are exemptions to the rights above and though we will always try to respond to your requests there may be situations where we are unable to do so (for example it may not be possible to provide copies of information which relates to the prevention and detection of crime or for which legal professional privilege could be claimed in legal proceedings).

If you would like further advice or information on your rights or wish to exercise them please write to our Information Governance Manager at The Engine House, Firefly Avenue, Swindon, SN2 2EH or email [email protected] .

If you are not happy with our response or you believe that your data protection or privacy rights have been infringed, you can complain to the UK Information Commissioner’s Office which regulates and enforces data protection law in the UK.  Details of how to do this are available at the Information Commissioner’s Office website at www.ico.org.uk.

Any concerns or queries about this privacy policy should be sent in the first instance to  [email protected]. 

This Privacy Policy was last updated on 2 September 2022.