Privacy Policy

We may collect and process your personal information for the purposes listed below

a) Donations, Funding, and Fundraising Activities

• Names and contact details
• Date of Birth
• Addresses (home and email)
• Financial transaction information
• Donation history
• Gift Aid consent
• Communication consent and preferences
• Communication history
• Employment Details

b) Crime Prevention, Detection, and Investigation

Shared only with relevant authorities upon request:

• Names and contact details
• CCTV/video recordings (indoor and outdoor areas)
• Financial transaction data
• Witness statements
• Health and safety information

c) Service Updates and Marketing

• Names and contact details
• Addresses
• Date of Birth
• Marketing preferences
• Photos or videos
• Purchase and donation history
• IP addresses
• Website/app user behaviour
• Records of consent (where applicable)
• Employment details
• Disability
• Wifi usage
• Usage data (e.g interaction with our services)

d) Research or Archiving Purposes

• Names and contact details
• Addresses
• Recorded images (photos/videos)
• Purchase and donation history
• IP addresses
• Website/app usage data
• Records of consent (where applicable)

e) Legal Compliance

• Name and contact details
• Financial transactions
• Health and safety data
• Contractual and transactional data

f) Recruitment

• Contact details
• Date of birth
• National Insurance number
• ID documents (passport/photo ID)<
• Bank details
• Employment and education history
• Right to work documentation
• Criminal convictions (e.g. DBS checks)
• Security clearance
• Next of Kin Information
• Disability
• Reasonable adjustments and IT requirements
• Contractual information

Special category data may include:

• Racial or ethnic origin
• Religious/philosophical beliefs
• Sexual orientation

g) Enquiries, Complaints or Claims

• Name and contact details
• Address
• Payment/account details
• Purchase or service history
• CCTV footage
• Witness statements
• Health and safety information
• Previous complaint data
• Correspondence

We process personal data for the following purposes:

• Performance of a contract
• Compliance with legal obligations
• Legitimate business interests
• Consent where required

Our Lawful Bases

We rely on the following lawful bases for collecting and using personal data:

• Consent - we have permission from you after we gave you all the relevant information. All your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
• Contract - we must collect or use the information so we can enter into or carry out a contract with you. All your data protection rights may apply except the right to object.
• Legal obligation - we must collect or use your information so we can comply with the law. All your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.

Each activity listed above is supported by one or more of these lawful bases.

Your Rights

You have the following rights under UK data protection law:

• Right of access – Request copies of your personal information
• Right to rectification – Ask us to correct inaccurate or incomplete data
• Right to erasure – Ask us to delete your personal information
• Right to restrict processing – Request limited use of your data
• Right to object – Object to the use of your data in certain circumstances
• Right to data portability – Ask for your data to be transferred elsewhere
• Right to withdraw consent – Where we rely on consent, you can withdraw it at any time

To make a rights request, please use the contact details above. We will respond to your request within one month.

More information about lawful bases and your rights can be found on the ICO website: https://ico.org.uk
 

• Directly from you
• Directly from you through consenting to connect to our public wifi
• Family members or carers
• Educational institutions
• Regulatory authorities
• CCTV and recordings
• Publicly available sources
• Market research organisations
• Credit reference agencies
• Previous employers
• Charities and voluntary organisations
• Suppliers and service providers
• Insurance companies
• Local authorities
• Other public sector organisations
   

We follow a defined Data Retention Schedule which outlines how long we retain personal data. This schedule will be publicly available via our website: Discover the Royal Navy like never before | Royal Navy Museums.

Consequences of Not Providing Personal Data

Where the provision of personal data is required to enter into or perform a contract, failure to provide such data may result in:

• Inability to enter into a contract with us
• Termination or suspension of services
• Delays in fulfilling contractual obligations

We will clearly indicate when personal data is mandatory and the consequences of not providing it.

We may share your information with the following categories of organisations or services:

Data Processors and Third-Party Services

• Charity Commission – Central record of trustees
• Companies House – Director records
• CIPHER Payroll – Payroll processing (staff only)
• Recruit Genie – recruitment website
• Insurance Companies – Claim handling
• PSF – Financial management system
• StaffSavvy – HR management system (staff only)
• Redeye (Spotler) – Email marketing
• Orlo – Social media monitoring
• Galaxy/Fever – Ticketing and membership platform
• Worldpay – Online payment processing
• Civic Computing – Website enquiry form handling
• Microsoft – The RNM are the Primary Data controller and control data access
• Microsoft Dynamics 365 – CRM platform
• goDonate – Donation and membership renewals
• Just Giving – Fundraising platform
• Octopus Legacy – Legacy pledges and will writing
• Braintree Payment Gateway (PayPal UK Ltd) – Recurring card payments
• Charities Aid Foundation – Donor management

Other Recipients

The following is a list of recipients who we may share your personal information with:

• Safeguarding organisations
• Emergency services
• Professional advisors
• Legal bodies and authorities
• Regulatory authorities
• External auditors
• Any other organisation we're legally required to share data with

We hold information about you aligned to our Data Retention Policy which can be found on our website.   

Automated Decision-Making and Profiling

We may use automated decision-making processes, including profiling, in limited circumstances, for example:

• Assessing eligibility for certain services, memberships, or ticketing offers 
• Supporting fraud detection and prevention, particularly for online transactions and donations 
• Personalising user experiences across our websites, digital services, and communications   

Where such processing produces legal or similarly significant effects, we ensure that:

• Appropriate safeguards are implemented to protect your rights and freedoms 
• You have the right to request human intervention in any automated decision 
• You can express your point of view and contest any decision made solely by automated means
   

The use of cookies disclaimer is available on our website which sets out what cookies are used and their purpose. The Use of Cookies Policy is also available on our website.

If you are concerned about how we are using your personal data, please contact us directly using the details at the top of this notice. If you're not satisfied with our response, you can contact the Information Commissioner’s Office (ICO):

Address:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Helpline: 0303 123 1113
Website: https://ico.org.uk/make-a-complaint
 

RNM Subsidiary Companies (registered at the same address as Royal Navy Museums): 

• NMRN Operations 
• NMRN Trading Company 
• Portsmouth Historic Dockyard Operations 
• NMRN Hartlepool 
• HMS Caroline Preservation Company 
• HMS Victory Preservation Company