Privacy & Data Protection

How we use personal data

We use personal data to:

• Provide services such as tickets, events, memberships and retail
• Manage relationships with visitors, members and supporters
• Carry out fundraising and charitable activities
• Improve our services and understand our audiences
• Keep people safe and secure at our sites
• Meet our legal and regulatory obligations

We process personal data in line with the UK GDPR and Data Protection Act 2018.

---

Our lawful bases

We only use personal data where we are allowed to by law. Depending on the activity, this includes:

• Contract – to deliver services you request
• Legal obligation – to comply with legal requirements
• Legitimate interests – for running our organisation in a fair and proportionate way
• Consent – where required, particularly for some marketing
• Vital interests – in rare cases to protect life

We explain the specific lawful basis in each activity notice.

---

Your rights

You have rights under data protection law, including to:

• Access your personal data
• Correct inaccurate data
• Request deletion in some cases
• Restrict or object to processing
• Receive your data in a portable format
• Withdraw consent at any time

You also have an absolute right to object to direct marketing.

To exercise your rights, contact us using the details above.

You can also complain to the ICO:
https://ico.org.uk

---

How long we keep data

We only keep personal data for as long as necessary for the purpose it was collected, unless we are required to keep it longer.

Some records may be kept permanently where they form part of our museum collections or archives for research purposes.

---

Who we share data with

We may share data with:

• Trusted service providers (e.g. ticketing, payments, IT systems)
• Regulators and law enforcement where required
• Professional advisers
• Partners where necessary to deliver services

We do not sell personal data.

---

CCTV and security

We use CCTV and, in some cases, body worn cameras to help keep visitors, staff and sites safe.

Images are usually retained for up to 30 days unless required for investigation.

---

Cookies

Our websites use cookies to provide functionality, improve performance and understand usage.

See our Cookie Notice: https://brightonmuseums.org.uk/cookies/

---

Bookings & Ticketing Privacy Notice

Purpose

To process ticket purchases, manage events and communicate with visitors.

What we collect

• Name
• Contact details (email, phone)
• Booking details
• Payment-related information (processed securely)
• Accessibility requirements (if provided)

How we use it

• Process bookings and issue tickets
• Contact you about changes or cancellations
• Provide customer support
• Keep financial records

Lawful basis

• Contract
• Legal obligation

Sharing

• Spektrix (ticketing provider)
• Payment providers
• IT and hosting services

Retention

Booking records are kept in line with financial and audit requirements.

---

Online Shop Privacy Notice

Purpose
To process online purchases and deliveries.

What we collect

• Name and address
• Email/phone
• Order details

How we use it

• Process orders
• Deliver goods
• Handle customer queries

Lawful basis

• Contract

Sharing

• Shopify (eCommerce platform)
• Payment processors
• Delivery services

---

Membership Privacy Notice

Purpose

To manage memberships and provide benefits.

What we collect

• Name and contact details
• Membership details
• Payment information
• Gift Aid declarations
• Interaction notes

How we use it

• Administer membership
• Send updates and renewal reminders
• Claim Gift Aid
• Provide benefits

Lawful basis

• Contract
• Legitimate interests

---

Fundraising Privacy Notice

Purpose

To manage donations and fundraising activity.

What we collect

• Name and contact details
• Donation history
• Gift Aid declarations
• Interaction notes

How we use it

• Process donations
• Claim Gift Aid
• Communicate with supporters
• Invite support for our work

Lawful basis

• Contract
• Legal obligation
• Legitimate interests
• Consent (where required)

Profiling

We may use limited profiling to better understand supporters and target communications.

You can object to this at any time.

---

Mailing Lists & Marketing Privacy Notice

Purpose

To send updates about events, offers and fundraising.

How we use data

We send marketing:

• with your consent; or
• where allowed under charity soft opt-in rules

(Charities can contact supporters without consent in some cases if conditions are met.)

Your rights

You can unsubscribe at any time using links in emails or by contacting us.

---

Surveys & Research Privacy Notice

Purpose

To understand visitors and improve services.

Special category data

Some surveys include demographic information.

• Usually anonymous
• If identifiable → we obtain explicit consent

Sharing

Shared in anonymised form only.

---

CCTV & Security Privacy Notice

Purpose

To ensure safety and prevent crime.

Data collected

• Video images
• In some cases audio (BWV)

Lawful basis

• Legitimate interests

Retention

Up to 30 days unless needed longer

Sharing

• Police
• Security partners
• Crime reduction partnerships

Notes

Clear signage is in place and use is proportionate

---

Activity-specific privacy notices

For more detailed information on the following, please see this page on Activity-specific privacy notices

Contact details
Royal Pavilion & Museums Trust
Royal Pavilion Gardens
Brighton
BN1 1FN

Registered charity: 1186986
Company registration: 11774969
Data protection registration: ZA791555

• Bookings & ticketing privacy notice
• Online shop privacy notice
• Membership privacy notice
• Fundraising privacy notice
• Mailing lists & marketing privacy notice
• Surveys & research privacy notice
• CCTV & security privacy notice

---

Enquiry Form