Privacy Notice | The Mary Rose
Mary Rose Trust Privacy Notice

 Last Updated: August 2022

Your privacy is important to us. This privacy notice explains what personal data we collect from you and how we use it. We encourage you to read the information below to understand more about how providing your information may affect you.

This privacy notice applies to the Mary Rose Trust and the Mary Rose Trading Company inclusively (together “The Mary Rose”). This notice also applies to www.maryrose.org and the Mary Rose App (collectively “sites”). The Mary Rose online shop is hosted externally on Museumshops.uk and their privacy notice can be found here.For the purpose of the UK General Data Protection Regulation 2018 (and any resulting legislation as amended of superseded), the Mary Rose Trust is the data controller of any personal data processed under this privacy notice.

The Mary Rose Trust is registered as a data controller under the Data Protection Act 2018, and our Data Protection Register number is: ZA344694

Changes to this privacy notice

We will update this privacy notice when necessary. When we post changes to this notice, we will revise the “last updated” date at the top of the notice and highlight what has changed. If there are any changes as to how The Mary Rose will use your personal data, we will notify you by directly sending you a notification. We encourage you to periodically review this privacy notice to learn how The Mary Rose is protecting your information.

 

Personal Data We Collect

The Mary Rose collects a small amount of data so that we can provide you with the best experience possible and to ensure we’re running our operations efficiently.

Most of the data collected will be provided by yourself on your terms, but in some cases, such as when using our sites, information from cookies and Google Analytics is sent to us.

Except as set out in this privacy notice, NO data that is collected, is given, shared or sold to any third parties.

Data given to us by you

We collect content of your files and communications when necessary to provide you with the products/services you use. For example, if you contact The Mary Rose by email, or by post, your data, such as email and/or postal address will be used to contact you regarding the reason as to which you contacted us with. Where appropriate, we may ask your permission to keep your data on a secure database, so as to keep you updated on events and news from The Mary Rose ONLY.

The transmission of information via the internet is not completely secure and we cannot guarantee the security of data while you are transmitting it.  No data transmission can be 100% secure and any data you transmit is at your own risk.

We have procedures and security features in place to keep your data secure once we receive it. We won’t share your information with any other organisations for marketing, market research or commercial purposes, and we don’t pass on your details to other websites.

Data we ask for

Any data we ask you for comes from:

  • you filling in forms on our website or by corresponding with us by phone, email, mail, in person or otherwise. This includes information you provide when you register for our newsletter, attend an event, make a donation, participate in a survey, make enquiries about your membership or about The Mary Rose and when you report a problem with our website;
  • literature such as membership leaflets and events booking forms in which it is your choice as to what data you provide us with.  

It is important that the personal data we hold about you is accurate and current.  Please keep us informed if your personal data changes during your relationship with us.

Personal information we collect about you might include:

  • your name, title, gender, date of birth
  • postal address, email address and phone numbers
  • payment details such as credit/debit card numbers, and whether you are a UK tax payer so that we can claim Gift Aid
  • details of correspondence sent to you/received by you
  • family, spouse, relationships to other donors or volunteers
  • current activities and interests
  • employment information, professional history
  • any other information provided by yourself to the Mary Rose Trust, that we feel is relevant to your relationship with us

Data given from external sources

Google Analytics, in conjunction with cookies, provides us with data regarding those who use www.maryrose.org, www.maryroseshop.org and our Mary Rose App.

Information collected in Google Analytics include the following:

Demographic data. Google Analytics collects and summarises your demographic data such as age, gender, country and preferred language through the use of cookies.

Usage data. Google Analytics collects and summarises data on how you interact with our website and app including:

  • Product use data. This is data on how you have used our website including any purchases you have made, and how long you’ve remained on any page on our website.
  • Device data. Data is collected about your device and the network you use to connect to our website and app. It includes data about the operating systems, browser, and service operator you use.
  • Interests and favourites. Data is collected so as to categorize what type of things interest you as a user via the use of cookies. Categories allow us to see if you’re a ‘travel buff’ or ‘outdoor enthusiast’, and whether you like ‘arts & entertainment’ or ‘reference/general reference/dictionaries & encyclopaedias’.
  • Location data. Data regarding your location is collected, which can be either precise or imprecise depending on your GPS settings.

 

Google Ads, in conjunction with cookies, provides us with anonymised data regarding the use of certain search terms and demographic information.  This data is used to improve and personalise your experience by showing you adverts that may be of interest to you.

 

For information on Cookies and how we use them, please visit www.maryrose.org/cookie-policy and read the ‘Cookies’ section.

ALL data gathered from external sources are used for report purposes ONLY and allows us to ensure we are providing the right services and content needed for our users. We can’t personally identify you using your data as data from these external sources is anonymised.

 

How We Use Personal Data

The Mary Rose uses the data collected for the following purposes:

  • to provide the necessary products and services we offer in order to comply with any contract between you and us;
  • which includes using data to improve and personalise your experiences, for example, through social media to show you adverts that may be of interest to you;
  • where it is necessary for our legitimate interests, i.e. to operate our charity/company and provide (including improving and personalising) the products and services we offer; 
  • for fundraising purposes, where we have a legitimate interest (examples include identifying the most efficient and effective way to interact with donors and prospective donors);
  • to send communications (including news, events and campaigns), where we have your consent to do so or where we have a legitimate interest;
  • where we need to comply with a legal or regulatory obligation.

Providing and improving our products. We use anonymised data, to analyse use of our sites in our legitimate interests in order to provide and improve the products and services we offer. This includes operating, and maintaining the performance of, the products and services, including developing new features, research and providing support. Examples of such uses include the following:

  • Providing the products/services. We use the data you’ve provided to carry out your transactions with us and to provide our products and services to you, as necessary for the performance of a contract between you and us. This includes sending relevant and necessary documentation and communications regarding the same.
  • Customer support. Your data may be used to help rectify an issue we have regarding the communications with you and any products or services that you have purchased, as required under the contract between you and us or if the particular issue doesn’t relate to a contract in ours and your legitimate interest, to ensure we provide you with a good service.
  • Product/service improvement. Your data may be used to help improve the products and services we provide, in our legitimate interest. You may be approached to be involved with surveys or feedback requests to help us understand what is needed to be improved.

Communications. We use data we collect to deliver and personalise our communications with you. For example, we may contact you by email or post to inform you when a membership is ending, in response to queries submitted to any of the sites, in regards to a purchase of a product or service, to inform you of any news or events about The Mary Rose ONLY. Additionally, there is the option to sign up for email subscriptions in which your data will only be used to send a newsletter to you regarding any updates about The Mary Rose.  Where you have previously purchased a product or service from us, we may send you communications about further products or services from us that we think may be of interest to you or updates about The Mary Rose.  

From September 2022 the Mary Rose Trust will operate under a new communications notice. While we continue to follow an opt-in approach for all email communications (referred to as ‘electronic direct marketing’ under the UK Data Protection Act) we will use ‘legitimate interest’ as the basis for our remaining direct marketing by post and phone. This means we will not seek opt-in consent to communicate with you by post or phone, and each communication will provide an opportunity to opt-out of future communications of this type. Supporters who have previously opted in (to any communication channel) will have their preferences respected as before. Where existing supporters re-engage with us, they will be presented with the new marketing permissions statement, and we will respect their latest instruction. You can change your marketing preferences at any time by emailing privacy@maryrose.org.

Opting Out. You can ask us to stop sending marketing messages at any time by clicking “unsubscribe” on the emails we send you or by contacting us at privacy@maryrose.org.  Where you opt out of receiving these marketing messages, this will not apply to personal data provided to us as a result of a product / service purchase.

Fundraising and campaigns. As a charity reliant on fundraised income, it is in our legitimate interests to carry out much of our fundraising activity. We will seek your specific consent to:

  • Use your image
  • Send you electronic communications (by email and text)
  • Hold any potentially sensitive personal information about you (for example your access requirements)
  • If relevant, list your full name on donor acknowledgment boards and Roll of Honour both online and within the museum, and in our printed materials.

We have legal and contractual obligations to carry out the following activity:

  • To communicate with you about your membership and the impact your support has made
  • If you make a donation, we’ll use any personal information you give us to record the nature and amount of your gift, claim gift aid where you’ve told us you’re eligible and thank you for your gift.
  • Charity Commission rules require us to know where funds have come from, as well as any conditions attached to them. We follow a due diligence process which involves researching the financial soundness, credibility, reputation and ethical principles of donors who’ve made, or are likely to make, a significant donation to the Mary Rose Trust. As part of this process we’ll carry out research using publicly available information and professional resources.

We rely on our legitimate interests for the following activity:

  • We may invite you to support our work by making a donation, getting involved in fundraising activities or leaving a gift in your will. 
  • We may use the information we hold about you to identify the most efficient and effective way to interact with you. This means we may use your past interactions with us to determine what activities we believe will be of interest and relevance to you.
  • Occasionally, we may invite some members and supporters to attend special events to find out more about the ways in which donations, gifts and legacies can make a difference to specific projects and to our cause. We will adhere to the marketing preferences you have provided us with.
  • We may sometimes also record details from conversations and interactions we have with you, if we feel it is relevant to your relationship with us. If it potentially sensitive information, we promise to check with you first before recording it.
  • If you tell us you want to fundraise to support our cause, we’ll use the personal information you give us to record your plans and contact you to support your fundraising efforts.
  • Major donors - Where relevant, we may undertake research to help us understand more about you as an individual. This enables us to use our limited resources effectively, focus conversations we have with you, and provide you with an experience as a donor or potential donor, which is appropriate to you. The information we gather is concerned with your professional, personal and charitable interests and your likely capacity to support us. Where we do this we use; Information we may hold about you on our database (such as a record of events you have attended, conversations or correspondence we have had with you in the past); Publicly available information from reputable sources, where you might expect your information to be read by the public. This includes professional profiles (LinkedIn, corporate biographies etc.), resources such as Companies House, the Charity Commission and charity websites, media coverage and third party publications such as the Sunday Times Rich List.
  • Leaving a gift in your will - If you’ve told us that you have left a gift in your will, or are thinking about doing so, we will keep details of this. If we have a conversation or interaction with you (or with someone who contacts us in relation to your will, such as your solicitor), we’ll make a note of these throughout your relationship with us, as this helps to ensure we direct your gift as you wanted. Where a donor has passed away and we are in the process of receiving their legacy gift, we will process personal data of individuals involved in the estate administration for the purpose of ensuring our compliance with legal obligations in receiving and using the legacy gift for our charitable purposes. Access to this personal data is restricted and stored for as long as necessary to administer our legacy.

If you would prefer us not to use your personal data in any of the ways described, please email us at privacy@maryrose.org or call 02392 750 521.

Cookies

The Mary Rose uses cookies (small text files placed on your device) on our sites to help collect data. We use analytical cookies so that our sites will remember you and how you’ve used the website or app, every time you return. Analytical cookies works in conjunction with Google Analytics and enables us to monitor the health of our website and which pages of our website are the most visited.

The data collected is anonymous and we’re unable to identify you personally.

You have the ability to disable any website using cookies via the settings on your browser, however this may limit what you might be able to see and use on our website. Unless you have adjusted your browser settings so that it will refuse cookies, our system will automatically issue cookies as soon as you visit any of our sites.

For more information on how to control cookies, please visit www.allaboutcookies.org.

 

Other Important Privacy Information

You’ll find additional privacy information in this section which you may find important.

Security of personal data

The Mary Rose has an obligation to protecting the security of your personal data. We use a variety of security procedures to help protect your personal data from unauthorized access, use or disclosure.

Where we store and process personal data

We store personal data you provide on computer systems that have limited access and are in controlled facilities. Most data is held in a database called Salesforce, for more information on their privacy notice please visit www.salesforce.com/uk/company/privacy.

Some data may also be processed by third party service providers such as payment processing providers and online ticket booking providers.

We take steps to ensure that the data we collect under this privacy notice is processed according to the provisions of this notice and the requirements of applicable law wherever the data is located.

Retention of personal data

The Mary Rose retains personal data for as long as necessary to provide the products and services and fulfil the transactions you have requested, or for other essential purposes such as complying with our legal obligations, resolving disputes and enforcing our agreements. When we no longer need to retain your information we will ensure it is securely disposed of, at the appropriate time. Some data, such as full name only, can be retained for all time, unless otherwise stated, due to archiving and charity records. For example, we keep records of names of divers on The Mary Rose, unless otherwise stated.

Your Rights

Where processing of your personal data is based on consent, you can withdraw that consent at any time.

You have the following rights.  You can exercise these rights at any time by contacting us at privacy@maryrose.org.  You have the right:

  • to ask us not to process your personal data for marketing purposes. We will inform you (before collecting your data) if we intend to use your data for such purposes or if we intend to disclose your information to any third party for such purposes;
  • to ask us not to process your personal data where it is processed on the basis of legitimate interests provided that there are no compelling reasons for that processing;
  • to ask us not to process your personal data for scientific or historical research purposes, where relevant, unless the processing is necessary in the public interest.
  • to request from us access to personal information held about you.  We aim to complete all access requests within 1 calendar month and provide the information free of charge;
  • to ask for the information we hold about you to be rectified if it is inaccurate or incomplete;
  • to ask for data to be erased provided that the personal data is no longer necessary for the purposes for which it was collected, you withdraw consent (if the legal basis for processing is consent), you exercise your right to object, set out below, and there are no overriding legitimate ground for processing, the data is unlawfully processed, the data needs to be erased to comply with a legal obligation or the data is children’s data and was collected in relation to an offer of information society services;
  • to ask for the processing of that information to be restricted if the accuracy of that data is contested, the processing is unlawful, the personal data is no longer necessary for the purposes for which it was collected or you exercise your right to object (pending verification of whether there are legitimate grounds for processing);
  • to ask for data portability if the processing is carried out by automated means and the legal basis for processing is consent or contract.

In the event that you are unhappy with our processing of your personal data, you have the right to lodge a complaint with the relevant supervisory authority, which is the Information Commissioner’s Office (ICO) in the UK, at any time.  The ICO’s contact details are available here: ico.org.uk/concerns.

For more information on Data Protection and your rights, please visit www.gov.uk.

How to contact us

Questions, comments and requests regarding this privacy notice are welcomed and should be addressed to:

Privacy Officer

The Mary Rose Trust
College Road
HM Naval Base
Portsmouth
PO1 3LX, UK
 

or sent to privacy@maryrose.org