Privacy Policy

Version 1.0 - 1 October 2024

This is the privacy policy of The Friends of Park Hill CIC, a community interest company registered in England and Wales, number 5444746. Our address is The Friends of Park Hill CIC, Electric Works, 3 Concourse Way, Sheffield S1 2BJ.

Our privacy policy is designed to comply with the laws of the United Kingdom, specifically with the Data Protection Act 2018, which incorporates the EU General Data Protection Regulation (GDPR) and the Privacy and Electronic Communications Regulations.

We may update this privacy policy occasionally and notify you of any changes by posting the new notice on this page. You are advised to review this privacy policy periodically for any changes.


Introduction
This policy describes how we collect, store, transfer and use personal data. It tells you about your privacy rights and how the law protects you.

In the context of the law and this notice, 'personal data' is information that identifies you as an individual or which could be used to identify you if combined with other information. Storing or using personal data is referred to as 'processing'.

This policy applies to personal data collected through our websites at www.friendsofparkhill.org, archive.friendsofparkhill.org and shop.friendsofparkhill.org and through the administration of our archive and oral history projects.

Except as set out below, we do not share, sell, or disclose any information collected through our websites to any third party.


The basis on which we process information about you
The law requires us to determine under which of six defined bases we process different categories of your personal data and to notify you of the basis for each category.

If the basis on which we process your personal data is no longer relevant, we shall immediately stop processing your data.

If the basis on which we process your personal data changes, then if required by law, we shall notify you of the change and any new basis under which we have determined that we can continue to process your information.


Your rights and your personal data
The basis we rely on to process your personal data may affect your data protection rights, which are set out below.

You can find out more about your data protection rights and the exemptions which may apply on the Information Commissioner's Office website: www.ico.org.uk.

Your right of access. You have the right to ask us for copies of the personal information we hold about you.

Your right to rectification. You have the right to ask us to correct or delete personal information you think is inaccurate or incomplete.

Your right to erasure. You have the right to ask us to delete your personal information.

Your right to restriction of processing. You have the right to ask us to limit how we can use your personal information.

Your right to object to processing. You have the right to object to the processing of your personal data.

Your right to data portability. You have the right to ask that we transfer the personal information you gave us to another organisation or to you.

Your right to withdraw consent. When we use consent as our lawful basis you have the right to withdraw your consent at any time.

If you make a request, we must respond to you without delay and within one month. To make a data protection rights request, please use the contact details at the top of this privacy notice.


When you purchase a membership, book tickets, or buy products/services from us

We will process:
Personal identifiers, such as your name and title
Contact information, such as your email address, telephone number and addresses for billing and delivery
Records of communication between us, including messages sent through our website, email messages and telephone conversations
Marketing preferences that tell us what types of marketing you would like to receive

Legal basis for processing:
We process this information on the basis that there is a contract between us. In order to carry out our obligations under that contract, we must process the information you give us.

Retention period:
We will continue to process this information until the contract between us ends or is terminated by either party under the terms of the agreement, for example, when your membership ends.
We will also retain or continue to process some information after the agreement has ended to comply with the law, including for the period demanded by our tax authorities.


When you contact us through our website, by email message, telephone or post

We will process:
Personal identifiers, such as your name and title
Contact information, such as your email address, telephone number and addresses for correspondence
Records of communication between us, including messages sent through our website, email messages and telephone conversations
Details of your correspondence, including files or attachments

Legal basis for processing:
We process this information on the basis that it is in the legitimate interest of our organisation to respond to your enquiry and retain details of enquiries or correspondence so that we can track our communications with you and provide a high-quality service.

Retention period:
We will delete all messages and other correspondence when we have replied to your message and/or resolved your issue/enquiry.
If you are a member, we will retain a record of your correspondence as part of your membership record until your membership ends.
Where a transaction has been completed, prepared or cancelled by email, it will be retained to comply with the law, including for the period demanded by our tax authorities.


When you offer to donate items for deposit in our archive, or we accept items for deposit in our archive

We will process:
Personal identifiers, such as your name and title
Contact information, such as your email address, telephone number and addresses for correspondence
Proof of your ownership of the items you wish to deposit
Details of any correspondence, including files or attachments
Information on how you wish to be credited as the item's donor if it is published online, used in exhibitions, reference, research, publications or for educational purposes.

Legal basis for processing:
We process this information on the basis that it is in the legitimate interest of our organisation to maintain records of where items donated to our archive came from for collection management purposes, and that it is in the public interest to maintain an archive of these historical materials in perpetuity.

Retention period:
Where you offer an item for deposit in our archive that we decline, we will delete your information after we have informed you of our decision.
Where your item is accepted for deposit into our archive, information about it and its donor will be recorded permanently in our Accession Registers, maintained in digital and paper formats.


Where you offer to take part in the recording of oral histories or where your oral history is recorded and placed in our archive

We will process:
Personal identifiers, such as your name and title
Contact information, such as your email address, telephone number and addresses for correspondence
Details of any correspondence, including files or attachments
Information on how you wish to be credited if your oral history is published online, used in exhibitions, reference, research, publications or for educational purposes
A summary of the content of your interview, which could contain personal information depending on what is discussed
An audio recording of your interview, which could contain personal information depending on what is discussed

Legal basis for processing:
We process this information on the basis that it is in the legitimate interest of our organisation and in the public interest to maintain an archive of oral histories for presentation online, in exhibitions and publications, and available for reference, research, and educational purposes.

Retention period:
If you offer to record an interview, but we do not accept your offer, we will delete your information after we have informed you of our decision.
Where your interview is recorded, we will permanently retain it and a written summary of the interview in our archive, subject to any embargoes or restrictions agreed to at the time of recording.


If you subscribe to our email newsletter(s)

We will process:
Personal identifiers, such as your name and title
Contact information, such as your email address

Legal basis for processing:
We process this information on the basis that we have received your explicit consent to do so when you signed up to receive email newsletters from us.

Retention period:
We will continue to process your information on this basis until you withdraw your consent or it can be reasonably assumed that your consent no longer exists.


Cookies
We provide more information about cookies and how we use them in our cookie policy.


Special personal data
We do not collect any special personal data (previously known as sensitive personal data) in our normal business operations. However, if you contribute an oral history to our archive, you may reveal details that could be considered special personal data.

Article 9, paragraph 2 (j) of the Data Protection Act 2018 states that we may process the special data categories where processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes. For the processing of special category data for archival purposes, we rely on Section 4(a) of Schedule 1 of the Data Protection Act 2018 – 'necessary for archiving purposes…in the public interest'.


Use of our services by children
Our products and services are intended for a general audience and are not intended for use by children under 13 years of age. We collect data about all users of and visitors to our websites regardless of age, and we anticipate that some of those users and visitors will be children.


Security
We use Secure Sockets Layer (SSL) certificates to verify our identity to your browser and to encrypt any data you give us. You can verify that information is being transferred using SSL by looking for a closed padlock symbol or other trust mark in your browser's URL bar or toolbar.

Whilst we take appropriate technical and organisational measures to ensure the security of your personal data, we cannot guarantee the security of all personal data that you transfer over the internet to us in every circumstance, for example, if we suffer a sophisticated cyber-attack.

In the event of a data breach that poses a risk to your individual rights and freedoms, we will notify the supervisory authority without undue delay and, at the latest, within 72 hours of becoming aware of the breach.


Payment information
We never take payment card information or transfer it to ourselves, either through our website or otherwise. Our employees and officers never have access to it.

At the point of payment, you are transferred to a secure page on our payment service provider's website. That page may be branded to look like a page on our website, but we do not control it.

We use Stripe for payments, analytics, and other business services. Stripe may collect personal data including via cookies and similar technologies. The personal data Stripe collects may include transactional data and identifying information about devices that connect to its services. Stripe uses this information to operate and improve the services it provides to us, including for fraud detection, loss prevention, authentication, and analytics related to the performance of its services. You can learn more about Stripe and read its privacy policy at https://stripe.com/privacy.


Data processed outside the UK/EEA
We host our websites in the United Kingdom and EEA.

Both the EU and UK governments have adequacy decisions in place, meaning that the legal protections afforded to personal data are the same in both geographic areas and can, as such, be transferred freely between those areas.

Some service providers we use may process your personal data outside the UK/EEA. They use various safeguards regarding data transferred outside the UK/EEA, including adequacy decisions, standard contractual clauses, binding corporate rules, and codes of conduct approved by a supervisory authority.


Data Retention
Except as otherwise mentioned in this privacy notice, we keep your personal data only for as long as required by us to provide you with the services you have requested, to comply with the law, including for the period demanded by our tax authorities or to support a claim or defence in court.

Data required for archiving purposes can be kept indefinitely and there is no requirement to keep archive data up to date.


Transfer of personal data
Our status as a community interest company means that if we were to cease trading, our archives and any other assets, including the personal data contained within them, would be transferred to another similarly regulated organisation. The Community Interest Company Regulator would approve and supervise this transfer, after which the information would be subject to the acquirer's privacy policies.


Service providers
We may share your personal data with businesses that provide services to us, or on our behalf.

As examples:
We may pass your information to our payment service provider to take payments from you
We may pass your contact information to agencies we use to send emails and other communications
We may pass your contact information to couriers so they can send you emails and text messages about deliveries

We ensure that any service providers we use have adequate protections for your personal data in place before contracting with them.


How to complain
If you have any concerns about our use of your personal data, you can contact us using the contact details at the top of this privacy notice.

If a dispute is not settled, we hope you will agree to attempt to resolve it by engaging in good faith with us in a process of mediation or arbitration.

If you remain unhappy after raising a complaint with us, you can also complain to the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. 0303 123 1113, www.ico.org.uk