We are the Science Museum Group and this policy sets out the basis on which we use personal data which we collect from or receive from other organisations we do business with. This includes other museums and cultural organisations, our contractors, persons to whom we provide licensing, consultancy and event services and persons making general enquiries in relation to the foregoing.
The ‘Science Museum Group’ is the trading name of the Board of Trustees of the Science Museum. The museums within our group are the Science Museum in London, the Museum of Science and Industry in Manchester, the National Science and Media Museum in Bradford, the National Railway Museum in York, Locomotion in Shildon and the National Collections Centre in Wroughton. We also produce the Manchester Science Festival.
This policy covers use of both personal information by the Board of Trustees of the Science Museum and our wholly owned trading company (called SCMG Enterprises Limited). We refer to ourselves within this policy as ‘we’ or ‘us’.
We collect information when you interact with us including (but not limited to):
- When you make enquiries in relation to our services;
- When you enter into a contract to receive goods and/or services from us;
- When you offer or advertise your services to us;
- When you enter into a contract to provide goods and/or services to us;
- When you enter onto our premises to provide your goods or perform your services;
- When you provide your contact details to us at industry networking events, conferences or during meetings;
- We also may collect information about you from third parties; and
- If you otherwise contact us by telephone, in person, email or post.
We may collect and process the following information from you:
Information obtained directly from you (for example, in person, over the phone, by post, or when you interact with us online. We may collect:
- Email address;
- Business Postal address;
- The name and type of the organisation you work for;
- Job title and role; and
- Contact telephone numbers and other relevant contact details (including any Webex details).
Where relevant we may also collect:
- Email preferences;
- Details of goods and services purchased by you and your organisation or provided by you and your organisation;
- Information provided in correspondence when you contact us;
- Payment details including in relation to your bank account;
- The details of employees, directors and other persons within your organisation;
- The details of other persons to whom our provision of services relates, for example attendees of events at our premises or other industry events, details of your subcontractors, or persons to whom we are to provide consultancy or training;
- Information in relation to the performance of contracts, reviews and meetings;
- Passports and/or other proof of identity and/or proof of address; and
- Any particular access or dietary requirements you may have which you provide to us.
We may also obtain information available from other external sources about you and combine it with information we hold about you. This will only be done if this information is publicly available (for example on Companies House, the land registry or credit checking agencies) or if you have given permission to a third party to share this information.
We use the information we hold about you for a number of purposes including to provide information you have asked for, to fulfil our contractual obligations to you, to receive the performance of your contractual obligations to us, to request additional information from you, to market industry specific events, opportunities or provide related news, to develop and improve our services and to otherwise operate our museums.
We may use your information in the following ways:
To fulfil our obligations under a contract with you and to otherwise carry out our business:
- Fulfilling contracts relating to goods and services which we are providing to you and vice versa;
- Processing payments from and to you (although please be aware we will not hold your payment details for any longer than necessary to process your transaction);
- Contacting you with any important information in relation to our contract with you;
- For the internal administration of any contract with you including with our finance, legal and procurement teams;
- Sharing your details with other specific third party partners who will contact you to let you know how they are using your information;
- Contacting you to respond to your queries (for example, if you email us with a question); and
- Fulfilling reporting obligations to our funders.
When it is in our legitimate interest to do so:
We shall use your information where it is in our legitimate interest to do so, which may include:
- Sending you emails about our services (or services provided at our museums), events, news and other opportunities relating to goods or services in respect of which you either contacted the us or have a contract in place in relation to. We will endeavour to ensure that these events are of interest to the email subscribers;
- Emailing you in relation to specific events or update about our museums;
- Contact you by telephone in relation to our services, specific events or updates in relation to the museum; and
- Store your personal information in relation to you on SMG’s contact database for the above purposes.
When we have a legal obligation to do so:
In appropriate circumstances we shall use your information to fulfil our legal obligations which may include:
- Detecting and reducing the risk of fraudulent transactions in person or online;
- Undertaking due diligence to detect fraud, money laundering and credit risk and protect the reputation of our museums;
- To keep our databases up to date including deleting or updating the information we hold about you if we learn such information is inaccurate;
- For our financial records;
- Such other obligations as are imposed on us from time to time;
- To comply with our security obligations in relation to our venues and collections;
- Complying with your data rights (as further described below in section 5);
- Health and Safety implications if appropriate, for example reporting first aid incidents; and
- The use of CCTV recording equipment on our premises for monitoring and security purposes.
We shall share your data with third parties who are connected with the performance of a relevant contract, to comply with our legal obligations or in order to enforce our rights, property or the safety of the Science Museum Group, our visitors or others.
We may share your personal information with the following organisations:
- Service providers working on our behalf. For example this may include payment processing, database services, website hosting services, providers or online and/or cloud services, printing and mailing organisations, marketing agencies and email delivery services;
- Our insurers in relation to any claim or issues in relating to our arising out of our insurance cover;
- In relation to events this may include providers of catering, audio-visual and other services relating to your event;
- Our auditors for the purpose of conducting audits of the Science Museum’s business information and accounts;
- Our security contractors for the purpose and
- Named third parties (provided we indicate such persons to you in advance).
If we are required to do so by law (for example under money laundering or charity law legislation, or under a court order) we may share your personal information with the police, other law enforcement or regulatory bodies or a government authority investigating unlawful activities.
You have the following rights under data protection laws in relation to your personal data, these rights include:
- To have accurate information held about you, and to have your details updated when they are inaccurate. If you prefer, you can contact us by email, telephone, by mail, or in person to update your details with us;
- To ask us to delete your data (often called the “right to be forgotten”). We might not always be able to delete it, under the law there are some circumstances in which we will need to, or are entitled to, hold on to it;
- To get a copy of your personal data. A subset of your data (limited to data that you have provided to us) is available in a machine-readable format if required;
- To object to how we use your data, and request that we stop using it for certain purposes. There may be circumstances where you ask us to restrict such uses of your information, but we are entitled to refuse that request. However, we shall always stop using your data for email marketing purposes at your request. Each marketing email we send to you will include details on how to change your communications preferences or unsubscribe from future communications.
- To withdraw your consent, where we are using your personal information with your consent (as described above in the ‘Why We Collect Your Personal Data and How we use it” section).
- To ask us to transfer your data to another organisation, where your data is held in a machine-readable, commonly used way, and can be safely transferred.
- If we make a decision about you using automated means, you have right to request that the decision be reviewed by a human; and
- The right to make a complaint to the Information Commissioner if you think that any of your rights have been infringed by us.
To exercise your rights, please use our contact details below.
We may request additional information so that we can verify your identity (and to ensure your personal information is not disclosed to any person who has no right to receive it). This may include:
- A colour copy of your driving licence, birth certificate or utility bill;
- Your company ID badge; and
- If your request relates to a specific transaction with the Science Museum Group, evidence of that transaction (i.e. a receipt or confirmation)
We may contact you to ask you for further information in relation to your request to help us enact your rights in accordance with the law.
We try to respond to all legitimate requests within one month. However, occasionally it may take us longer than a month if your request is particularly complicated or you have made a number of requests. In such circumstances, we will notify you.
- The country we send the data to might be approved by the European Commission as being sufficiently secure;
- The recipient is located in the United States and is a certified member of the approved EU-US Privacy Shield Scheme; or
- The recipient company might have signed up to a contract obliging them to protect your information.
In all such cases we shall ensure that any transfer of your information is compliant with data protection law.
However, please note that the transmission of data via the Internet is not completely secure. Your communications may be routed through a number of counties before being delivered. We cannot guarantee the security of any data transmitted to our Websites, however, once we have received your data, we will use adequate security procedures to prevent unauthorised access.
The Science Museum Group has registered with Information Commissioner’s Office. These registrations are in the name of the Board of Trustees of the Science Museum Group (registration number Z3140818) and SCMG Enterprises Limited (registration number Z7613339).
If you would like more information or would like to raise any queries, exercise your rights or make a complaint relation to our use of your personal information, you may contact our Data Protection Officer using the following details:
Data Protection Officer
National Science and Media Museum
Science Museum Group
Little Horton Lane