Privacy Notice
We are committed to protecting the privacy and security of your personal information and to being transparent about the information we collect and use.
Using personal information helps us develop a better understanding of our visitors, participants, supporters and donors. It also allows us to provide relevant and timely information about Mostyn’s exhibitions, events, learning programmes, fundraising and other activities.
This privacy notice explains how Mostyn Gallery Limited collects and uses personal information obtained directly from you and, in some circumstances, from third parties.
We use personal information in accordance with the UK General Data Protection Regulation, the Data Protection Act 2018 and other applicable data protection laws.
This notice explains:
- what personal information we may collect about you
- how we may use it and the legal basis for doing so
- when we may share it with third parties
- how we use cookies and similar technologies on our website
- how we keep personal information secure and how long we retain it
- your rights in relation to your personal information
If you have any questions about this notice or wish to exercise your rights, please contact us at [email protected].
Who we are
Mostyn is operated by Mostyn Gallery Limited, a registered charity in England and Wales (Registered Charity No. 507842) and a company limited by guarantee (Company No. 01378599). We are registered with the Information Commissioner’s Office under registration reference ZB272471.
In this privacy notice, “Mostyn”, “we”, “us” and “our” refer to Mostyn Gallery Limited.
Our registered address is:
Mostyn
12 Vaughan Street
Llandudno
Conwy County
LL30 1AB
This privacy notice explains how we collect, use and protect personal information in connection with Mostyn’s activities, including our website, CCTV systems, bookings, donations, venue hire and learning programmes.
It does not apply to Mostyn’s shop, which is covered by a separate privacy policy.
What personal information we collect
We only collect personal information that is necessary for Mostyn to carry out its activities, provide services, run events and learning programmes, manage donations and fundraising, and communicate with visitors, participants, supporters, funders and others who engage with us.
Information you give us
We collect personal information that you provide to us when you book tickets or events, make a donation, hire a space, take part in a learning programme, contact us, or otherwise interact with us.
Depending on the activity, this may include:
- your name and contact details
- your postal address
- payment information
- accessibility or dietary requirements, where you choose to provide them
- emergency contact details where relevant to an event or activity
- age information for children or young people taking part in certain activities, where relevant
Donations and supporter information
If you make a donation to Mostyn, we may collect and keep a record of information including your name, contact details, postal address, Gift Aid declaration and UK taxpayer status where relevant, and details of your donation history.
Donations to Mostyn may be made in a number of ways, including directly, by bank transfer, or through third-party platforms such as CAF (Charities Aid Foundation) and GoodBox. Where you make a donation through a third-party platform, your information will also be subject to that provider’s own privacy notice and terms.
We use Mailchimp to manage newsletter communications, including communications with donors and supporters who have asked to hear from us. Where your information is processed by Mailchimp, it will also be subject to Mailchimp’s own privacy notice.
Mailing list, attendance and correspondence records
If you sign up to hear from us, we may collect your name, email address and marketing preferences. We use Mailchimp to manage our mailing lists and email communications. Where your information is processed by Mailchimp, it will also be subject to Mailchimp’s own privacy notice.
We use Eventbrite for event bookings. Eventbrite has its own privacy notice, but we may keep limited information from bookings, such as your name and email address, for attendance records and archive purposes.
If you contact us by email, through our website or by other means, we may keep a record of your correspondence and any information you provide so that we can respond to your enquiry and manage any follow-up.
Social media
Mostyn uses social media platforms to share news, promote exhibitions and events, and communicate with audiences. If you contact us through social media, send us a direct message, or otherwise interact with our content on those platforms, we may receive and process personal information such as your username, profile name and the contents of your message or comment.
We may use this information to respond to enquiries, manage communications, promote our activities and keep a record of relevant correspondence where necessary.
Please note that social media platforms operate under their own privacy notices and terms, and Mostyn does not control how those platforms use your information.
Information collected when you visit Mostyn
When you visit Mostyn, we may collect certain information in connection with security, safety and the documentation of our activities.
This may include:
- CCTV footage, including video recordings, for the purposes of security, staff safety, the prevention and investigation of incidents, and evidencing abusive or threatening behaviour where necessary
- photographs and video recordings taken at exhibitions, events, workshops or other activities for documentation, marketing and promotional purposes
If we take photographs or video at a public event or activity, we will aim to do so in a way that is fair and proportionate and, where appropriate, make people aware that recording is taking place.
Special category personal data
Data protection law gives extra protection to certain types of particularly sensitive personal information, known as special category personal data.
Mostyn only collects this type of information where it is necessary and appropriate to do so. This may include:
- access requirements or accessibility information that you choose to share with us when booking or taking part in an event, workshop or other activity, so that we can support your visit or participation
- equal opportunities monitoring information provided by job applicants, staff or volunteers, where this is collected for monitoring purposes
- DBS or safeguarding-related information where this is necessary for particular roles, volunteer activities or safeguarding responsibilities
Where we collect special category personal data, we will only do so where we have a lawful basis under data protection law and, where required, an additional condition for processing that information.
Legal basis for processing your information
We will only process your personal information where we have a lawful basis to do so under data protection law. The lawful bases we rely on include:
Contract
We process personal information where it is necessary to enter into or perform a contract with you. This includes, for example, administering ticket bookings, event or workshop bookings, venue hire arrangements and other services you have requested from us.
Legal obligation
We process personal information where we are required to do so by law. This includes, for example, keeping records for accounting and tax purposes, processing Gift Aid information, and carrying out safeguarding or DBS-related checks where required.
Consent
We rely on consent where you have chosen to receive marketing communications from us, such as newsletters and email updates, or where you choose to provide certain optional information to us. Where we rely on consent, you can withdraw it at any time.
Legitimate interests
We may process personal information where it is necessary for Mostyn’s legitimate interests, provided those interests are not overridden by your rights and interests. This may include:
- administering and reporting on our activities
- maintaining attendance and archive records
- responding to enquiries and correspondence
- fundraising administration and supporter relationship management
- protecting the safety and security of our staff, visitors and premises, including through the use of CCTV
- preventing and investigating incidents, including abusive or threatening behaviour where relevant
How we use your information
Processing bookings, hires, donations and other transactions
If you book an event or workshop, hire a space, make a donation or otherwise request a service from us, we will use your personal information to administer that request and provide the relevant service.
This may include using your information to:
- process bookings, donations and other transactions
- contact you by email or telephone about your booking, event, venue hire or donation
- notify you of cancellations, changes or practical arrangements
- manage attendance records and event administration
- keep financial and audit records relating to transactions
Where relevant to venue hire or the delivery of an event, your information may also be shared internally with staff or contractors involved in organising or supporting the activity, such as front of house, technical, operational or catering staff.
Analysis, insight and reporting
We may use personal information to help us understand our audiences, participants, supporters and donors, and to evaluate and improve our work.
This may include analysing information such as attendance records, bookings, donations, postcode information, audience engagement and participation in our programmes. We may use this information for internal planning, reporting to funders, evaluating projects and understanding how people engage with Mostyn.
Where possible, reporting will be anonymised or aggregated so that individuals are not identified.
Responding to enquiries and managing correspondence
If you contact us by email, through our website, through social media or by other means, we may use your personal information to respond to your enquiry, keep a record of the correspondence, and manage any follow-up or related administration.
Marketing communications
If you ask to hear from us, we may use your personal information to send you news, updates and information about exhibitions, events, learning activity, fundraising and other aspects of Mostyn’s work.
We mainly communicate by email. We use Mailchimp to manage our mailing lists and email communications. You can unsubscribe from marketing emails at any time by using the unsubscribe link in the email or by contacting us at [email protected].
Fundraising and supporter administration
As a charity, fundraising is an important part of supporting Mostyn’s work. We may use personal information relating to donors and supporters in order to:
- process and acknowledge donations
- maintain records of donations and Gift Aid declarations
- comply with our legal and financial obligations
- keep in touch with donors and supporters who have asked to hear from us about supporting Mostyn
- administer our fundraising activity and supporter relationships
Who we share personal information with and why
We do not sell your personal information to third parties.
We may share personal information with trusted third-party service providers who help us operate Mostyn and deliver our services. Depending on the circumstances, this may include providers involved in website hosting, email communications, event bookings, donation processing, accounting, cloud storage and IT services. These may include providers such as Mailchimp, Eventbrite, CAF, GoodBox, Google Workspace / Google storage, Clook and Sage.
Where you use a third-party platform to book an event, sign up to communications or make a donation, your information will also be subject to that provider’s own privacy notice.
We may also share personal information where necessary with:
- artists, facilitators, tutors, technicians, caterers or other delivery partners involved in running an event, learning activity or venue hire, where this is necessary to deliver the activity safely and effectively
- the police or other relevant authorities where necessary for the prevention or investigation of crime, security incidents or abusive behaviour
- legal or professional advisers, insurers or other professional services where necessary for legal, regulatory or risk-management purposes
We may provide information to funders and supporters for reporting and evaluation purposes, but this will normally be anonymised or aggregated and will not identify individuals unless there is a specific lawful reason for doing so.
Where third parties process personal information on our behalf, they are required to do so only on our instructions and to keep that information secure.
How we use cookies and website technologies
When you visit Mostyn’s website, we may collect certain information automatically through cookies and similar technologies. This may include information about how you use the website, your IP address, browser type, device information and pages visited.
We use Google Analytics to help us understand how visitors use our website and to improve its performance and content. We also use the website to provide features such as newsletter sign-up and links to donation services.
Our website uses a cookie banner or consent tool to help manage cookie preferences. You can control cookies through that tool and through your browser settings.
Where you use third-party services or links made available through our website, such as newsletter sign-up tools, event booking services or donation platforms, your information may also be processed by those third parties in accordance with their own privacy notices.
If you apply for a job or volunteer role with Mostyn
If you apply for a job or volunteer role with Mostyn, we will collect and use personal information as part of the recruitment process.
This may include:
- your name and contact details
- information contained in your CV, application form or covering email
- details of your employment history, education and qualifications
- references and information relevant to your suitability for the role
- equal opportunities monitoring information where this is collected separately
- right to work information and identification documents where required
- DBS or safeguarding-related information where this is necessary for the role
We use this information to assess your application, communicate with you about the recruitment process, carry out checks where required, and maintain appropriate recruitment records.
Applications are normally submitted by email. We will only use recruitment information for recruitment, safeguarding, legal, regulatory and related administrative purposes, and we will retain unsuccessful applicant records in line with our retention periods.
Transfers of personal information outside the UK
Some of the third-party services used by Mostyn may store or process personal information outside the United Kingdom. This may happen, for example, where cloud-based systems or communications platforms are hosted internationally.
Where personal information is transferred outside the UK, we will take reasonable steps to ensure that it is protected appropriately and that any transfer is carried out in accordance with applicable data protection law.
How long we keep your information
We will only keep personal information for as long as it is reasonably necessary for the purposes for which it was collected, including to meet legal, accounting, safeguarding and reporting requirements.
Retention periods may include the following:
- CCTV recordings: normally retained for three weeks, unless footage is required for the investigation or reporting of an incident, including police involvement, in which case it may be kept for longer where necessary
- Gift Aid, donation and accounting records: retained for 6 years from the end of the last financial year to which they relate
- Recruitment records for unsuccessful applicants: normally retained for 12 months
- Booking and attendance records: retained where necessary for accounting, audit and reporting purposes, in line with legal and financial record-keeping requirements
- Marketing preferences and suppression records: retained so that we can respect your communication choices
- Correspondence and enquiry records: retained for as long as necessary to manage the enquiry, maintain an appropriate organisational record, and deal with any follow-up issues
In some cases, we may keep information for longer where there is a legal requirement to do so, where it is needed in connection with a complaint, dispute or safeguarding matter, or where it is necessary to establish, exercise or defend legal claims.
Security of your personal information
Mostyn takes the security of personal information seriously and uses appropriate technical and organisational measures to help protect it against unauthorised access, loss, misuse, alteration or disclosure.
These measures may include restricted access to personal information, password-protected systems and accounts, secure cloud-based services and hosting, and procedures for identifying and responding to data protection incidents.
We limit access to personal information to those staff, volunteers, contractors and service providers who need it for legitimate business purposes.
Children’s information and safeguarding
Some of Mostyn’s activities and learning programmes involve children and young people. Where we collect personal information in connection with those activities, we take appropriate care to protect that information and to handle it in a way that is fair, proportionate and consistent with our safeguarding responsibilities.
In some cases, personal information may be provided by a parent or guardian on behalf of a child or young person, for example in connection with bookings, participation in activities, emergency contact information or access requirements.
Where appropriate, we apply additional safeguards to information relating to children and young people, particularly where safeguarding responsibilities apply.
Your rights
Under data protection law, you have a number of rights in relation to your personal information. These include:
- the right to request access to the personal information we hold about you
- the right to request correction of inaccurate or incomplete personal information
- the right to request erasure of your personal information in certain circumstances
- the right to request restriction of processing in certain circumstances
- the right to object to processing in certain circumstances, including direct marketing
- the right to request transfer of your personal information to you or another organisation in certain circumstances
- the right to withdraw consent at any time where we rely on consent to process your information
These rights are not absolute and may be subject to legal exemptions.
Complaints
If you have concerns about how Mostyn handles your personal information, please contact us first at [email protected] and we will try to resolve the issue.
You also have the right to make a complaint to the Information Commissioner’s Office (ICO), the UK regulator for data protection matters. Further information is available from the ICO at www.ico.org.uk.
Contacting us
If you have any questions about this privacy notice, wish to exercise your rights, or want to raise a concern about how we process your personal information, please contact:
Mostyn
12 Vaughan Street
Llandudno
Conwy County
LL30 1AB
Email: [email protected]
