The MRL Programme is committed to protecting and respecting your privacy.
This page explains when and why we collect personal information and how we endeavour to repay the trust you have shown in sharing your personal data with us. It applies to you if you’re a participant, applicant, employee, delivery partner, volunteer, business contact or if you visit our website, email, call or write to us.
Who are ‘we’?
In this policy, whenever you see the words ‘we,’ ‘us’ or ‘our’, it refers to the MRL Programme, which is administered by Black Country Living Museum Trust (BCLM) a registered charity (no. 504481) and limited company (no. 01226321).
BCLM is registered with the Information Commissioner’s Office under the Data Protection Act 1998, and our Data Protection Register number is: Z7620282.
What information do we collect about you?
When you interact with us:
We collect the personal data that you give when you interact with us, for example making an enquiry, making an application, or generally communicating with us. If you do not provide us with the requested personal information we may not be able to properly perform our contract with you, for example we may not be able to consider you as a participant.
The information will be retained for legitimate business interest reasons and will include things like:
- Personal details (name, date of birth/age, gender, email, address, telephone number and place of employment).
- Details of correspondence sent to you, or received from you.
If you are an applicant you will also be asked to provide equal opportunities information. This is not mandatory information – if you don’t provide it, it will not affect your application. Any information you do provide, will be used only to produce and monitor equal opportunities statistics.
When you get involved with us:
We collect the personal data that you give when you get involved with us, whether that’s through becoming a participant, becoming a delivery partner or mentor, volunteering with us or working for us. This information will be retained for legal, contractual and legitimate business interest reasons and will include, for example:
- Personal details (name, date of birth/age, gender, email, address, telephone number, place of employment, ethnicity and disability).
- Financial information (payment information such as credit or debit card or direct debit and bank account details).
- Interaction history (attendance at sessions).
- Details of correspondence sent to you, or received from you.
We will ask you about your previous experience, education, qualifications, and referees and for answers to questions relevant to how you become involved with us.
If you become an employee you will also be asked to provide equal opportunities information. This is not mandatory information – if you don’t provide it, it will not affect your application. Any information you do provide, will be used only to produce and monitor equal opportunities statistics, so, for example, to monitor barriers to employment. In addition, further information relating to health and criminal convictions and bank account details will be sought. This information will be retained for legal or contractual reasons.
What do we do with your information?
When we ask you to provide your personal information we will let you know why we are asking, and how we will use your data, by directing you towards this policy.
If you have interacted with us, for example as a Programme applicant:
We will send you essential communications, regardless of your contact preferences, deemed necessary to fulfil our obligations to you in relation to your application and keep you informed about future cohort recruitment.
All of the information you provide during the application process will only be used for the purpose of progressing your application, or to fulfil legal or regulatory requirements if necessary. We will not share any of the information you provide during the recruitment process with any third parties for marketing purposes. The information you provide will be held securely by us whether the information is in electronic or physical format. We will use the contact details you provide to us to contact you to progress your application. We will use the other information you provide to assess your suitability for the Programme. You don’t have to provide what we ask for but it might affect your application if you don’t.
If you are involved with us, for example as a participant, delivery partner, mentor or employee:
We need to process personal data of participants, delivery partners, mentors and employees in order to comply with our contractual, statutory, and management obligations and responsibilities and use your contact details as part of the ongoing delivery of the Programme.
As a participant, your name, place of employment and image will be used on the MRL website and other platforms, such as Twitter, to promote the Programme.
How do we keep your information up to date?
We ask that you keep us up to date if any of your personal details change but we will contact participants periodically to ensure personal information is as up to date as possible.
Who might we share your information with?
We do not disclose personal data to any third parties or external organisations other than those listed below as part of the delivery of the MRL Programme:
- Any party approved by you.
- As an applicant to the Programme, your application details will be shared with delivery partners as part of the application process.
- As a participant, your contact details will be shared amongst your cohort and with our delivery partners.
- As a delivery partner, your contact details will be shared amongst the cohort of participants.
- Government bodies or regulators: where we are required to do so by law or to assist with their investigations or initiatives.
- Police, law enforcement and security services: to assist with the investigation and prevention of crime and the protection of national security.
- Other service providers: for example, email marketing specialists, printers, payment processors, data analysis, promotional advisors, contractors or suppliers and IT services. Any such companies are acting as approved data processors for MRL and we retain full responsibility for your personal data. Data processors will act only on our instructions.
Some of our suppliers run their operations outside the European Economic Area (EEA). Although they may not be subject to the same data protection laws as companies based in the UK, we will take steps to make sure they provide an adequate level of protection in accordance with UK data protection law.
Your data will never be sold or passed to any third party for any other purpose.
How do we keep your information secure?
Your personal data is kept across a number of different electronic and hard copy systems to meet the business needs of the MRL Programme. The Programme has policies and procedures in place to ensure that your information is only accessible by individuals that need it to perform their job.
Certain data, for example some sensitive information, is additionally controlled and is only made visible to members of staff who have a reason to work with it. However, there will be other data, for example names, job titles and images, which is accessible to all staff and will be in the public domain via the MRL website.
If we use external companies to process any personal data on our behalf, we do comprehensive checks on these companies before we work with them, and put a contract in place that sets out our expectations and requirements, especially regarding how they manage the personal data they have collected or have access to.
How long do we keep your information for?
We will only use and store your data for as long as it is required for the purposes it was collected. The period of retention depends on the information being held, what it is being used for and in some cases, legal requirements (for example, any financial transactions which we are legally required to keep for six years).
We keep a retention of records policy detailing all of this information. When we no longer need to store your data we will always dispose of it securely.
How can I access the information about me, and/or correct or delete information?
You can ask us if we are keeping any personal data about you and you can also request to receive a copy of that personal data – this is called a Subject Access Request.
To make a Subject Access Request you will need to provide adequate proof of identity such as a copy of your passport, birth certificate or driving licence and proof of your address, before your request can be processed.
Please try to be as clear as possible about the information you require including where the data is likely to be held and the date range of the information you wish to access.
Once we have received your Subject Access Request, and proof of identity, you will receive a response from us within 30 days and you will be able to get copies of any information we hold on you. However, exemptions to disclosure may apply in some circumstances.
A Subject Access Request should be sent to:
Black Country Living Museum Trust
At any time you may request that we correct or delete your personal information, which we will do as long as there are no legitimate or legal reasons (as outlined in the general data protection regulation) for us to retain and process that data, for example if it’s necessary for us to carry out the purpose for which you have provided it to us. In either of the above circumstances, please contact email@example.com.
For further information see the Information Commissioner’s guidance on the Information Commissioner’s Office website.
Links to third party websites
Use of ‘cookies’
Like most websites, we receive and store certain details whenever you use our website. We use ‘cookies’ to help us make our site – and the way you might use it – better. Cookies mean that a website will remember you and enable online transactions. It also helps us understand how you use our website, where we can make improvements and how best to tell our audiences about events they might be interested in.
Changes to our privacy notice
We regularly review our privacy notice, and may make changes from time to time. Any changes made will be posted to this page, and will apply from the time we post them. This privacy notice was last updated in May 2018.
How to contact us
If you have any comments on our privacy notice, or information we hold about you please contact the MRL administrator at the address given above or via email firstname.lastname@example.org.