The Chester Beatty Library
Your Personal Data
We collect “personal data”, which is information that identifies a living person, or which can be identified as relating to a living person.
When we talk about “you” or “your” in this policy we mean any living person whose personal data we collect.
When we talk about “Friends” or “Friends Membership” we are referring to subscribing members of the Chester Beatty Friends programme.
Personal data we hold
The categories of personal data we hold are listed below.
1. Personal data you provide
We collect data you provide to us. This includes information you supply when you communicate with us, apply for a Friends membership, purchase tickets, products or services, sign up to receive communications from us, make a donation, apply for employment, volunteer or enter into a contract with us. For example, we may hold:
- personal details (name, gender, date of birth, email, address, telephone etc.)
- family and spouse/partner or next of kin details
- financial information (credit/debit card details are not retained but encrypted once entered, and whether your donations are gift-aided);
- your response to a special Chester Beatty event or your intention to meet a member of our staff; and details of the ways in which you wish to be contacted by us.
- If you purchase a Friends membership as a gift for someone your details will be recorded (as will the recipient’s) and your relationship to that person will be recorded.
2. Personal data generated by your involvement with the Chester Beatty
Your activities and involvement with the Chester Beatty will result in personal data being generated. This could include:
- details of your areas of interest in the Chester Beatty’s Collection
- your visits to our reference library
- your attendance at special events
- where you have asked us for information or written to us
- your visits to our website
- images of you captured by our CCTV systems
- your use of our public wi-fi and mobile apps
- your purchasing history
- how you have helped us by volunteering or by donating money or objects to us
- where you have applied for a job with us
3. Website cookies
The museum website located at https://chesterbeatty.ie utilises persistent website cookies to support the overall functionality of the resource. The cookies utilised record the following data
- Tracks return visits, to direct the animations presented to the user in the visit content
- Provide anonymised website analytical data to the Google Analytics platform, which includes pages visited, and content downloads clicked
4. Personal data from third parties
We sometimes receive personal data about you from third parties, for example, if we are partnering with another organisation or where we may use third parties to help us conduct research and analysis about you to determine the success of our public offer and to help us provide you with a better experience (and this can result in new personal data being created).
We may collect information from social media about you, or if you post on any of our social media pages.
Occasionally, we may collect personal data about you (for example, if you are particularly well known or influential) from the media and other publicly available sources. This may come from public databases, news or other media.
5. Special category (‘sensitive’) personal data
We do not normally collect or store special categories of personal data. However, there are some situations where we may need to do so. These may include, for example, if you work or volunteer with us or apply to do so, or if we need to know about any access, medical or dietary requirements you, or someone in your care, may have.
How we use your personal data
1. General use
We only ever use your personal data with your consent, or where it is necessary in order to:
- enter into, or perform, a contract with you
- comply with a legal duty
- protect your vital interests
- carry out a task in the public interest
- for our own (or for a third party’s) legitimate interests, provided your rights do not override these interests.
In any event, we will only use your personal data for the purpose or purposes for which it was obtained.
We may use your personal data to communicate with you in order to promote our activities and events and to help with fundraising. This includes keeping you up to date with our exhibitions, events and products in our shops, and to send you general information about fundraising, Friends membership and other ways you may be able to support us or benefit from the Chester Beatty.
We use your personal data for administrative purposes including:
- receiving donations
- maintaining databases of our Friends and other supporters
- processing Friends subscriptions
- performing our obligations under Membership contracts and other supporters’ agreements
- managing custody of our collection including our intellectual property rights
- carrying out due diligence to meet our compliance duties (for example, before making any acquisition into our collections, accepting financial support or making agreements for the supply of goods and services)
- processing enquiries and requests for information
- managing feedback, comments and complaints we receive
- fulfilling orders for tickets, goods or services (whether placed online, over the phone or in person)
- helping us respect your choices and preferences
- recruitment and staff management including pay, tax and pensions administration
- management of suppliers of goods and services
- managing your visit to the Chester Beatty (e.g. health and safety; security, lost property, cloakroom and incident management)
4. Internal research and profiling
We occasionally carry out research and analysis on our visitors, Friends and other supporters to determine the success of our public offering and programmes and other activities in the public interest and to help us provide you with a better experience (for example so that you only receive communications about areas of our activities or research you are mostly likely to be interested in).
We may evaluate, categorise and profile your personal data in order to tailor materials, services and communications (including targeted advertising) to your needs and your preferences and to help us to understand our audiences. For example, we may keep track of the amount, frequency and value of your support including your philanthropic involvement elsewhere. This information helps us to ensure communications are relevant, timely and in the best interest of our charitable purposes.
Disclosing and sharing your personal data
We will never sell your personal data. If you have opted-in to marketing, we may contact you with information about our activities. These communications will always come from us.
We may share your personal data with contractors or suppliers who provide us with services. For example, we may use a mailing house for the distribution of the Chester Beatty ‘What’s On’ guide; we use Direct Debit processors for the handling of payments and email providers for our marketing communications. Information is transferred to data processors securely, and we retain full responsibility for your personal data as the Data Controller. These activities are carried out under a contract which imposes strict requirements on our suppliers to keep your personal data confidential and secure.
Occasionally, we arrange events with other organisations and we may share your personal data with such organisations – for example where you register to attend a co-hosted event. We will only share information when necessary.
We may share your personal data where required to do so for prevention of crime or for taxation purposes or where otherwise required to do so by other regulators or by law.
Fundraising and marketing communications
Unless you have already given us your email address or telephone number so that we can tell you about making donations to us or about the supply of goods and services, we must ask you to “opt-in” to receive fundraising and marketing emails from us. You have the choice as to whether you want to receive or continue to receive these messages. You are also able to select how you want to receive them (post, email) and to change your preferences at any time.
When you receive a communication from us, we may collect information about your response and this may affect how we communicate with you in future.
2. Newsletters and magazines
If you are a Friend, we will send you the Chester Beatty Magazine (unless you specifically ask us not to) and you can choose to unsubscribe from general marketing communications to Friends without cancelling your subscription to the Chester Beatty Magazine.
If you are on our ‘What’s On’ mailing list, we will send you this newsletter (unless you specifically ask us not to).
Children and young people
We take great care to protect and respect the rights of individuals in relation to their personal data, especially in the case of those aged 18 or younger.
We will not use the personal data of children or young people for marketing purposes and we will not profile it. Personal data about children and young people is only accessible by selected staff on a strictly need to know basis.
Wi-Fi and other sensing systems
We operate a Wi-Fi system, counting systems and other sensing systems to detect movement within the Chester Beatty’s premises.
Free Wi-Fi access is available throughout the Chester Beatty. If you access the Chester Beatty’s free Wi-Fi network, you will be asked to agree to the Chester Beatty’s Wi-Fi terms and conditions of use, which explain how your data will be used.
We record anonymous data about the location and type of devices in the Chester Beatty that have Wi-Fi enabled and other sensing data, for security and so that we can monitor the flow of visitors around the building and improve our services.
We will not link the anonymous device data with any other personal data that identifies you individually without your express permission. If in the future we want to process your data in this way to offer you new services, we will ask you via a consent form before doing so.
We employ a variety of physical and technical measures to protect information we hold and to prevent unauthorised access to, use or disclosure of your personal data.
Electronic data and databases are stored on secure computer systems and we control who has access to information (using both physical and electronic means). Staff receive data protection training and we maintain a set of data protection procedures which our staff are required to follow when handling personal data.
2. Payment security
All electronic forms that ask you for your financial data will use the Secure Sockets Layer (SSL) protocol to encrypt the data between your browser and our servers.
If you use a payment card to donate, to buy a Friends Membership or to purchase something from us on-line, we will pass your payment card details securely to our payment provider. We comply with the payment card industry data security standard (PCI-DSS) published by the PCI Security Standards Council.
The Chester Beatty premises are protected by CCTV and you may be recorded when you visit the Chester Beatty. We use CCTV to help provide a safe and secure environment for visitors, for our staff and for the collection and to prevent or detect crime.
The system is managed in accordance with our standard operating procedures and with good practice guidance. CCTV images will only be accessed by authorised security staff and are stored for up to 30 days, unless flagged for review.
4. Where your data is stored
We are wholly based in the Ireland and store data within the European Economic Area. Some organisations which provide data processing services to us do so under contract and may be based outside of the EEA. We will only allow them to do so if your data is adequately protected.
5. Retention of your personal data
We will only retain your personal data for as long as it is required for the purposes for which we collected it (for example, we have a genuine and legitimate reason and we are not harming any of your rights and interests). This will depend on our legal obligations and the nature and type of information and the reason for which we collected it. For example, should you ask us not to send you marketing emails, we will stop storing your email address for marketing purposes; however, we will need to keep a record of your preference.
We continually review what information we hold and will delete personal data which is no longer required, and in line with our Record Retention Policy.
Control of your personal data – Your rights
We want to ensure you remain in control of your personal data and that you understand your legal rights, which are:
- the right to know whether we hold your personal data and, if we do so, to be sent a copy of the personal data that we hold about you (a “subject access request”) within 30 days
- the right to have your personal data deleted (though this will not apply where it is necessary for us to continue to use the data for a lawful reason)
- the right to have inaccurate personal data rectified
- the right to object to your personal data being used for marketing or profiling
- (where technically feasible) the right to be given a copy of personal data that you have provided to us (and which we process automatically on the basis of your consent or the performance of a contract) in a common electronic format for your re-use.
There are some exceptions to the rights above and, although we will always try to respond to any instructions you may give us about our handling of your personal information, there may be situations where we are unable to meet your requirements in full.
If you would like further information on your rights or wish to exercise them, please contact our Data Protection Officer: firstname.lastname@example.org
Should you have a complaint about how we have used (‘processed’) your personal data, you can complain to us directly by contacting our Data Protection Officer in the first instance: email@example.com
If you are not happy with our response, or you believe that your data protection or privacy rights have been infringed, you can write to the Office of the Data Protection Commissioner: Canal House, Station Road, Portarlington, Co. Laois, R32 AP23, Ireland.
Links to other sites