Privacy Notice

As our services are wide-ranging this Privacy Notice is designed to cover the principal points of contact the customer may have with us but it does not cover every interaction the customer may have with the Museum. We endeavour to advise our customers how their data is managed when we interact with them. If you have any questions about how your data is managed please contact:

The Museum Records Team

National Maritime Museum

Park Row

London, SE10 9NF

Email: MuseumRecords@rmg.co.uk

For the purposes of the Data Protection Act, the Data Controller is the Board of Trustees of the National Maritime Museum.

What personal information do we collect about you?

We collect personal information about you, such as your name and address and the details we require for payment, when you register with us, book tickets or place an order for products or services. We also collect information when you voluntarily complete customer surveys, provide feedback and participate in competitions. Website usage information is collected using cookies.

What is our legal basis for processing your personal data?

There are six available lawful bases for processing as set out below. All data processing covered in this Privacy Notice establishes which of the following legal bases is being applied. All data processing activities carried out by Royal Museums Greenwich are documented and you may ask for further details if the activity is not covered in this Privacy Notice.

Consent: the individual has given clear consent for us to process their personal data for a specific purpose.
Contract: the processing is necessary for a contract we have with the individual, or because they have asked us to take specific steps before entering into a contract.
Legal obligation: the processing is necessary for us to comply with the law
Vital interests: the processing is necessary to protect someone’s life.
Public task: the processing is necessary for us to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law.
Legitimate interests: the processing is necessary for our legitimate interests or the legitimate interests of a third party, unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests.

How will we use the information about you?

We collect information about you to process any orders, manage any accounts and, if you agree by giving us your consent, to contact you with updates about our latest news, events and offers which we think may be of interest to you.

We will collect and process data where it is necessary to do so for our legitimate interests (for example we may collect and process data of supporters and potential supporters from publicly available sources). We collect data for purposes of administration (to keep an up-to-date record of our relationships and administer donations), to further our charitable aims and to facilitate a supporter journey of the best possible standard.

We may also use your information to improve the relevancy of our marketing communications. We will never share your information with third parties for their marketing purposes without your consent. We will never sell your information to third parties.

How will we protect your data?

We follow appropriate security procedures in the storage and disclosure of personal data so as to guard against loss, damage and unauthorised access by third parties and have robust technological solutions to ensure your personal data is protected from unauthorised access. We also require those external parties to whom we transfer personal data to comply with the same.

What rights do you have in relation to your personal information?

You have a number of legal rights in relation to your personal data:

The right to be informed - Individuals have the right to be informed about the collection and use of their personal data
The right of access - Individuals have the right to access and receive a copy of their personal data, and other supplementary information. This is commonly referred to as a subject access request or ‘SAR’
The right to rectification - The UK GDPR includes a right for individuals to have inaccurate personal data rectified, or completed if it is incomplete.
The right to erasure - The UK GDPR includes a right for individuals to have personal data erased. The right to erasure is also known as ‘the right to be forgotten’.
The right to restrict processing - Individuals have the right to request the restriction or suppression of their personal data in certain circumstances.
The right to data portability - Allows individuals to obtain and reuse their personal data for their own purposes across different services.
The right to object -The UK GDPR gives individuals the right to object to the processing of their personal data in certain circumstances.
Rights in relation to automated decision-making and profiling. The UK GDPR has provisions on:

automated individual decision-making (making a decision solely by automated means without any human involvement); and
profiling (automated processing of personal data to evaluate certain things about an individual). Profiling can be part of an automated decision-making process.

Please note that the above rights may not apply in all circumstances and requests may be refused where legal exemptions apply. If you wish to exercise any of the above rights please write to the Data Protection Officer at rmgenquiries@rmg.co.uk.

CCTV

CCTV is in use across all RMG sites to help ensure the safety of visitors, staff, collections, and property, and for the prevention and detection of crime. Notices are displayed at access points. As images are captured of everyone on and around the immediate perimeter of RMG sites, this may include children and vulnerable groups.

The system is managed in line with recommendations from the Information Commissioner’s Office guidance, police, and Security Industry Association requirements.

Recordings are kept securely for a maximum of 28 days. Extracts may be kept longer for purposes of an investigation into a security or safety incident, or for a Subject Access Request. Extracts may be shared with the police or other agencies for the purposes of an investigation.

Email Newsletter

We would like to send you information about our latest news, offers and events via our email newsletter. We will only do this with your consent.

As indicated in our sign-up statement, we may also occasionally include promotions from other museums and our partners, if we think the content will be of interest to you. For example, this could include sending a discount offer for a product or service offered by one of our partners (example: Visit Greenwich or Greenwich Comedy Festival), or some information about an exhibition which is on at another Museum.

If you have signed up to our newsletter you can opt out at any time by clicking the ‘Unsubscribe’ link at the bottom of any newsletter. You can also ask to be deleted from our list at any time by contacting rmgenquiries@rmg.co.uk.

If you have purchased a ticket from us, or registered to buy a product from our online shop, then we will send you related news and offers. We do this under the guidelines of the Privacy and Electronic Communications Regulations which permit email communications with an existing customer who bought (or negotiated to buy) a similar product or service from us in the past. You can opt out of this by indicating your preferences while giving us your details. You can also opt out at any time by clicking the ‘Unsubscribe’ link at the bottom of any newsletter. Or you can ask to be deleted from our marketing list at any time by contacting rmgenquiries@rmg.co.uk.

We use Force24 to send our Royal Museums Greenwich email newsletter and Force24 securely stores your personal data on our behalf. The entire Force24 application is encrypted to secure your personal data.

We use Mailchimp to send additional marketing emails, outside of the Royal Museums Greenwich email newsletter, and Mailchimp securely stores your personal data on our behalf. The entire Mailchimp application is encrypted to secure your personal data.

On occasion, we may encourage you to join our newsletter through Facebook advertising, or run competitions requiring you to submit your email address. This activity may be run on our behalf by third parties who will only process the data for the purpose of choosing a competition winner or subscribing you to our newsletter (if you have explicitly given consent). They will only collect the data for these purposes and they will not store it for longer than is necessary, use the data for their own purposes, or share it with any third parties. Your data will always be collected, processed and stored in compliance with GDPR regulations.

Cookies

Cookies are text files placed on your computer to collect standard internet log information and visitor behaviour information. This information is used to track visitor use of the website and to compile statistical reports on website activity.

We use Google advertising cookies to:

Create Remarketing Audiences based on specific behaviour, demographic, and interest data, and share those lists with Google Ads.
Create Segments based on demographic and interest data. For more information about Google's advertising cookies, visit the Google Advertising Privacy FAQ.

We also use the Facebook Pixel to understand conversion tracking, and for optimisation and remarketing purposes for Facebook advertising. For more information about the Facebook Pixel see Facebook's Data Policy.

If your browser permits you can set your computer to reject cookies, although this may affect the quality of your visit. Depending on your web browser, you may also be able to block or delete specific cookies using browser tool settings. You can opt out of Google Analytics Advertising Features through Ads Settings, Ad Settings for mobile apps, or any other available means (for example, the NAI's consumer opt-out). Get more information on Google opt-out options.

To find out more, read our cookie policy.

Google Analytics

We use Google Analytics to monitor how people use our websites and aggregate general statistics about customers, traffic patterns and related site information. It is always collected and analysed in an anonymous form.

Booking tickets online

Our ticket booking system is provided by Gateway Galaxy. The booking system collects personal information on behalf of the Museum and enables us to process your transaction. We only use personal data where it is necessary to fulfil your order, communicate key information, products, services and feedback related to your ticket, visit or interests, and deliver customer support services. The processing is necessary for a contract we have with you. We will not disclose personal data to other parties.

We shall retain information relating to your booking for a period of six years after your association with us has come to an end to comply with statutory limitation periods.

If you make a booking and have opted into our email newsletter we may also use your information to improve the relevancy of our marketing communications.

Royal Museums Greenwich has partnered with Wire & Sky to deliver the Cutty Sark Rig Climb Experience. Royal Museums Greenwich will share personal data with Wire & Sky where it is relevant and applicable in delivery of the service. This processing is necessary for a contract we have with you. Wire & Sky may contact you in relation to the Cutty Sark Rig Climb Experience only.

Using our online shop

Our Online Shop is provided by Shopify and Cybertill. Shopify and Cybertill collect information about you on our behalf in order to process any transactions and manage any accounts. This processing is necessary for a contract we have you. We only use personal data where it is necessary to fulfil your order, communicate key information, inform you of products and services related to your transaction or interests, and deliver customer support services. Shopify and Cybertill use encryption to secure your personal data.

Your personal information may be disclosed to other businesses within the Museums' partnerships and to reputable third parties who will help process your order. The National Maritime Museum requires all such third parties to treat your personal information as fully confidential and to fully comply with all applicable UK Data Protection and consumer legislation. We will not release your personal information to any company outside of the National Maritime Museum for mailing or marketing purposes.

We shall retain data related to your purchases for a period of six years after your association with us has come to an end to comply with statutory limitation periods.

If you agree by giving us your consent, we may contact you with updates about our latest news and offers which we think may be of interest to you. We may also use your information to improve the relevancy of our marketing communications. For more information see the Newsletter section above.

Membership

We will use your personal details to administer your Membership in accordance with the current Data Protection Act, General Data Protection Regulation, and as otherwise permitted or required by law. We will send Membership material by post such as your Membership welcome pack, Members’ magazines, What's On guides and Members’ Appeal information.

As part of your Membership, you will receive e-newsletters, invitations to events and information on how you can get further involved with supporting Royal Museums Greenwich by email. You can opt out at any time by contacting us at membership@rmg.co.uk.

Your personal details are stored in the Membership database for the duration of your Membership and for 6 years after your Membership expires in order to comply with statutory limitation periods; after that we will dispose of your details securely. This processing is necessary for a contract we have you.

If you are a Member of the Flamsteed Astronomy Society, your email address will also be used by the Flamsteed Committee to communicate with you.

Keeping a record of your interactions with us

We maintain a customer relationship management (CRM) system to hold contact details and a record of your interactions with us such as ticket purchases, memberships, using the online shop, and attendance at special events. This is for analytical and customer research purposes which is in the Museum's legitimate interests to continue to improve our understanding of our target audiences and supporters. The system we use is called Microsoft Dynamics CRM. We are committed to storing your data securely. Access to customer information is strictly controlled. The CRM system can only be accessed by people who need it to do their job.

We may retain information in our CRM for a period of six years after your association with us has come to an end. If you do not want us to retain your data for analytical or customer research purposes you have the right to request us to delete it for being used for this purpose. To do so please contact  rmgenquiries@rmg.co.uk.

If you have consented to email marketing, we may also use your information to improve the relevancy of our communications.

Venue Hire and Corporate Events

All personal data provided to us as part of an event enquiry are tracked and kept securely on a third party database. Data for enquiries that do not proceed is deleted after two years, or immediately on receiving a request from yourself. Your personal data is necessarily shared by you, or by us under agreement from you, with parties such as caterers and florists acting under your instructions to provide your event. Documentation and correspondence regarding confirmed events are deleted after six years.

We would like to send you information about industry news, upcoming events and venue highlights via our email newsletter, but we will only do this with your consent.

We use Mailchimp to send our email newsletter and Mailchimp securely store your personal data on our behalf. The entire Mailchimp application is encrypted to secure your personal data and we will never share your data with third parties for their marketing purposes.

Online donations 

Online donations and recurring donations can be made through our website using services provided by Blackbaud Europe Ltd.

Royal Museums Greenwich shares the transaction data with our payment services provider Blackbaud only to the extent necessary for the purposes of processing, amending and refunding your payments. Requests to amend or cease recurring donations should be made to donate@rmg.co.uk.

Your personal data will be stored and used by Royal Museums Greenwich in accordance with this Privacy Notice to fulfil the purposes for which the information was originally collected. This processing is necessary for a contract we have with you. 

Royal Museums Greenwich Development Team maintains records of your interactions with us regarding fundraising, events and activities. This is for analytical and customer research purposes which is in the Museum's legitimate interests to continue to improve our understanding of our target audiences and supporters. The system we use is Raiser’s Edge NXT (RENXT). We are committed to storing your data securely. Access to customer information within RENXT is strictly controlled; it can only be accessed by people who need it to do their job.

With your consent, we may also contact you with further opportunities for you to support Royal Museums Greenwich. You have the right to opt-out of receiving these communications from us. To do so, please email donate@rmg.co.uk.

We retain this information for a period of six financial years after your association with us has come to an end. If you do not want us to retain your data for analytical or customer research purposes, you have the right to request us to delete it for being used for this purpose. To do so please contact donate@rmg.co.uk.

Social media

We use social media to broadcast messages and updates about Royal Museums Greenwich. On occasion, we may reply to comments or questions you make to us on social media platforms.

You may also see adverts from us on social media that are tailored to your interests. See the section on cookies above for further information about the Facebook Pixel.

Depending on your settings and the privacy policies used by social media and messaging services like Facebook or Twitter, we may receive non-personally identifying demographic or analytical information that enables us to better understand the reach and effectiveness of our advertising.

Our website also uses the Facebook and Twitter share functionality on some pages.

Find out more about privacy on Facebook.

Find out more about privacy on Twitter.

Other websites

Our website contains links to other websites. This privacy policy only applies to websites managed by the Museum, so if linking to other websites please refer to their privacy policies for further information.

Changes to our Privacy Notice

We keep our Privacy Notice and all associated schedules and policies under regular review and we will place any updates on this web page. This Privacy Notice was last updated on 22 November 2024.

If you have any questions about this Privacy Notice please contact:

The Museum Records Team

National Maritime Museum

Park Row

London, SE10 9NF

Or email: MuseumRecords@rmg.co.uk

For independent advice about data protection, privacy and data sharing issues, you can contact the Information Commissioner at:

Wycliffe House, Water Lane

Wilmslow, Cheshire, SK9 5AF

For more information, please their website: ico.org.uk