Privacy Notice - Manx National Heritage

Privacy Notice Updated April 2023 (Version 1.9)

This Privacy Notice explains:

What information is collected and why
- - Who is collecting it
  - How it is collected
  - Why it is being collected
  - How it will be used
How long it will be kept
Who it will be shared with
How that information will be kept secure
Transfers of information outside of the EEA
Your choices, including how to access and update information

When we collect your personal information we will:

only collect what we need and no more
keep your information secure
tell you how we will use your information
delete your information when it is no longer needed
only process your information in line with rules set out in the Data Protection Act 2018.

This notice may be replaced, or more information added, when you use a specific service.

If we decide to change our Privacy Policy we will post changes to this Privacy Notice. If you have any questions or comments on this Privacy Notice please contact our Data Protection Officer (please see “Contact us” for contact details).

Who we are

The data controller is Manx Museum and National Trust, trading under the name Manx National Heritage (“MNH”). We recommend you take some time to read this notice and if you do not agree to this privacy notice do not provide us with your personal information.

Contact us

Contact details for MNH are provided below. MNH also has a designated Data Protection Officer (DPO). If you wish to contact the DPO directly you can write to the DPO at the address provided below, or email DPO-MNH@gov.im

Manx National Heritage
Manx Museum
Kingswood Grove
Douglas
Isle of Man
IM1 3LY

Email: enquiries@mnh.im
Tel: 01624 648000

What information is collected and why

When you use a MNH service, including using our websites www.manxnationalheritage.im, isleofmanher.im, www.imuseum.im or accessing MNH’s services through gov.im, we may ask you to share personal information with us. Any data you submit or send via these websites is sent at your own risk. We collect and process information, including personal information, to provide effective and efficient services and to meet our statutory obligations.

We use your personal information in line with the rules set out in the Data Protection Act 2018 for the following reasons:

To provide access to services provided by MNH online and offline
Where you have agreed to the processing
Accounts and records such as for processing goods and service payments you make to us or we make to you
Advertising, marketing and public relations such as communicating with you about our news, products, services and events
To analyse use of the websites and make improvements
To comply with our statutory obligations under the Manx Museum and National Trust Act such as for the protection of the Island’s historic monuments, archaeology, archives, arts, biological and conservation
Historic and research records
Education such as the arranging of cultural and historical training events
Estate and property management such as tenancies, rented, leased and holiday accommodation
Staff administration
Volunteer administration
Board of Trustees administration
CCTV for the prevention, detection of crime and prosecution of offenders

We will only process your personal information if there is a legal reason for us to do so. We may rely on:

Your consent – if we rely on your consent to process your information you may withdraw your consent at any time by unsubscribing using the links in electronic correspondence, updating your preferences by contacting manxnationalheritage@mnh.im or by contacting the Data Protection Officer (please see above for contact details).
The need to meet a legal obligation in carrying out statutory government functions including our obligations under the Manx Museum and Trust Act 1959. Please find a link to the legislation here
The need to meet a request you have made for information, a service or to make a purchase
The need to prevent or investigate suspected or actual violations of law, complaints and investigations
The need to protect public interest
The need to retain information for historical or archiving purposes by the Public Record Office under the Public Records Act 1999 – more information on retention is available from the Public Records Office

Types of personal information we collect about you

Depending on how you interact with us we may process different information about you. Below you will find an overview of the categories of information that we may collect.

If you use a link to any website you should make sure you read the privacy notice on that website page to find out what it does with your information.

Information you provide to us directly

This is information about you that you give us by filling in forms on our sites www.manxnationalheritage.im or www.imuseum.im or by corresponding with us by phone, e-mail or otherwise.
It includes information you provide when you register to use our websites, subscribe to our service, search for a product, place an order on our site, participate in discussion boards or other social media functions on our site, enter a competition, promotion or survey and when you report a problem with our site.
It also includes information you provide when you attend one of our ticketed events or when you support our work as a donor, trustee, employee, volunteer, supplier or partner organisation, including for events management, the annual Heritage Open Days and renting any of our holiday or residential accommodation.
The information you give us may include your name, address, e-mail address and phone number, financial and credit card information, personal description and photograph.

Category of data	Examples of that type of data
Account login information	Login ID, password, or security questions
Contact information	Your name, email address, telephone number, address and relatives, guardians or other persons associated with you
Financial data	Invoice number, amount, bank details We hold partial credit or debit card information
Government identifiers	Driving licence number, NHS number, national insurance number
Health information	General symptoms, source of pain, diagnosis, dietary requirements
Other information	Feedback, comments, complaints
Personal identification data	Name, title, date of birth, image including photograph or film
Education details	Qualifications, training establishments and examining bodies

Information we collect automatically

When you visit any of our websites we will automatically collect the following information:

technical information, including the Internet protocol (IP) address used to connect your computer to the Internet, your login information, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform.
information about your visit, including the full Uniform Resource Locators (URL), clickstream to, through and from our site (including date and time), products you viewed or searched for, page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs), methods used to browse away from the page.

When you visit or use our website we may collect information sent to us by your computer, mobile phone, or other device. For example we may collect:

Category of data	Examples of that type of data
Device information	Hardware model, operating system version
Log information	Time and duration of visit
Other information	Links you click, location
Tracking information	When you visit this site we use cookies that do not collect any personal data. Read more about under Cookies

How long we keep your personal information

We will only keep your information for the minimum time necessary.
This may be to:

Comply with our statutory obligations such as retaining accounting and tax records
Respond to an enquiry from you
Continue to give you access to a service you have requested

Who it will be shared with

We may share your information with:

Other Government Departments, Boards, Offices and the Friends of Manx National Heritage to provide a service or information you have requested
Our partners and suppliers to ensure you receive the services you have requested
Our commercial partners in the event of a complaint by you, subject to your prior agreement.
Third party suppliers such as Island Escapes for booking our visitor accommodation and software suppliers for the maintenance of our records.
The police or law enforcement agencies where there is a legal requirement to do so
The courts on production of a valid court order

We will not sell to, or share, your personal information with other companies, organisations or individuals other than as above.
We will share your personal information with other companies, organisations or individuals where there is a legal requirement to do so.
Your personal information will not be disclosed to any third party without your prior consent unless we are required to do so by law.

Photography and filming

We will not produce or use images of you individually or in small groups without obtaining your prior consent. This includes photographs and film, taken for example at our events or sites, to be used in our news, promotional and social media communications. You have a right to withdraw your consent at any time, but please note that it may be difficult to remove images if they have been published.

How that information will be kept secure

The security and confidentiality of your information is very important to us.
We will ensure that:

Safeguards are in place to make sure personal information is kept securely
Only authorised staff are able to view your information

Transfer of information outside the EEA

We may transfer data outside of the European Economic Area. We make sure appropriate safeguards such as contracts or other agreed standards are in place.

Your choices, including how to access and update information

What are your rights?

To ask if we hold personal information about you

You can ask to see what information we hold about you by submitting a Subject Access Request. Please contact our DPO for assistance with this (see “Contact us” above).
In certain circumstances a charge may apply.
Subject access requests must be responded to promptly and in any event within a maximum of 1 month.

You can review your personal information and ensure it is accurate

Where possible we will provide you with access to the information we hold about you so that you can view this information and provide a means for you to have this information changed if it is not accurate.

To remove your personal information

In certain circumstances you can ask for your information to be deleted. Please note that as part of Manx National Heritage’s statutory functions some information may need to be retained.

You can make any of these requests by contacting the Manx National Heritage Data Protection Officer (please see “Contact us” above).

To make a complaint

If you are not satisfied with the way we deal with your personal information you can submit a complaint to the Manx National Heritage Data Protection Officer (please see “Contact us” above) who will work with you to resolve any issues.

The Information Commissioner is the independent authority responsible for upholding the public’s information rights and promoting and enforcing compliance with the Island’s information rights legislation. Further information can be found on the Information Commissioner’s website here.

You have the right to request the Information Commissioner to undertake an assessment as to whether the processing of your personal data has been carried out in accordance with the provisions of the Data Protection Act 2018.

Will this Privacy Notice change?

This Privacy Notice may change. We will not reduce your rights under this Privacy Notice without your consent. If any significant change is made to this Privacy Notice we will provide a prominent notice on our websites so that you can review the updated Privacy Notice.

This Privacy Notice may be replaced, or more information added, when you send feedback, ask to use a service online or make a payment for a service through this website. This privacy notice was last updated April 2023 (Version 1.9).

Cookie Policy Updated April 2023 (Version 1.5)

Cookies

Cookies are small text files that are placed on your computer by websites that you visit. They are widely used in order to make websites work, or work more efficiently, as well as to provide information to the owners of the site.

We use cookies to ensure you get the best experience on our website. You can refuse the use of cookies by selecting the appropriate settings on your browser, however, if you do this you may not be able to use the full functionality of MNH’s websites.

The About Cookies website has more information about cookies and instructions for managing and deleting cookies in different browsers.

Visitors to our websites

When someone visits www.manxnationalheritage.im, isleofmanher.im or www.imuseum.im we use a third party service, Google Analytics, to collect standard internet log information and details of visitor behaviour patterns. We do this to find out things such as the number of visitors to the various parts of the site. This information is only processed in a way which does not identify anyone. We do not pass on identifiable information to Google. If we do want to collect personally identifiable information through our website, we will be up front about this. We will make it clear when we collect personal information and will explain what we intend to do with it.

Use of cookies on manxnationalheritage.im, isleofmanher.im or www.imuseum.im

The table below explains the cookies we use and why.

Cookie	Name	Purpose	Expires
Google Analytics Cookies	_ga	Used to distinguish users. You can opt out of Google Analytics cookie.	2 years
Google Analytics Cookies	_gat	Used to throttle request rate.	10 minutes
Google Analytics Cookies	_ _utma	Determines the number of unique visitors to the site	2 years
Google Analytics Cookies	_ _utmb	This works with _utmc to calculate the average length of time you spend on our site.	30 minutes
Google Analytics Cookies	_ _utmc	This works with _utmb to calculate when you close your browser.	When you close your browser
Google Analytics Cookies	_ _utmvz	This provides information about how you reached the site (e.g. from another website or a search engine).	6 months
Google Analytics Cookies	_ _utmv	Used to segment visitors to the site by specific activity. It contains no specific customer data other than the IP address of your device.	2 years
WordPress Cookies	wordpress_{random character string}	Used to store account information about customers and our back office staff for their time using the site, such as account management and shop checkout.	2 weeks
WordPress Cookies	wordpress_logged_in {random character string}	Used to store account information about customers and our back office staff for their time using the site, such as account management and shop checkout.	2 weeks
WordPress Cookies	wordpress_test	This is a test cookie used by WordPress to identify if cookies are enabled in the current user’s session.	2 weeks
WordPress Cookies	wp-settings-{userid}-{variable string}	Used by us to set what areas of the back office can be viewed or edited by our back office staff.	2 weeks
WooCommerce Cookies	woocommerce_cart_hash	This cookie stores the content of the users ‘basket’. No personal information is stored within the cookie.	At the end of the user’s session
WooCommerce Cookies	woocommerce_items_in_cart	Stores the number of items in the user’s basket. No personal information is stored within the cookie.	At the end of the user’s session
WooCommerce Cookies	wp_woocommerce_session_	Contains a unique code for each customer so that it knows where to find the basket data in the database for each customer. No personal information is stored within the cookie.	At the end of the user’s session