Privacy Policy

1. About this policy

Cultural Data Trust C.I.C. is committed to handling personal information lawfully, fairly, transparently and securely.

This Privacy Policy explains how we collect and use personal information when you:

• visit the Cultural Data Trust website;
• contact us by email or through our contact form;
• ask us a question about our work, data stewardship or future options;
• ask to receive updates;
• express an interest in supporting, partnering with or working with us; or
• otherwise communicate directly with the Cultural Data Trust.

This policy concerns personal information handled by Cultural Data Trust C.I.C. in its own capacity.

2. Who we are

Cultural Data Trust C.I.C. is an independent Community Interest Company dedicated to public benefit and trusted cultural data infrastructure.

Registered office: 27 Old Gloucester Street, London WC1N 3AX
Email: info@culturaldatatrust.org

For the purposes of UK data protection law, Cultural Data Trust C.I.C. will be the controller of personal information where it determines why and how that information is processed.

3. Information we may collect

Depending on how you interact with us, we may collect:

Contact information

• your name;
• job title;
• organisation;
• email address; and
• telephone number, if you provide it.

Enquiry and correspondence information

• the content of messages you send us;
• the subject of your enquiry;
• information you choose to provide about your organisation or use of cultural data services; and
• records or notes created when responding to your enquiry.

Updates and engagement information

• whether you have asked to receive updates;
• your communication preferences;
• your interest in supporting, partnering with or working with us; and
• information connected with meetings, consultations or events.

Website and analytics information

If you consent to analytics cookies, Google Analytics may collect aggregated information about how you use the website, including:

• pages viewed;
• approximate location derived from IP address;
• browser and device information;
• referring website;
• interaction information; and
• technical information used to measure website performance and usage.

See our Cookie Policy for more information.

4. Contact form information

When you submit information through our Contact Us form, we will store the information you provide so that we can:

• respond to your enquiry;
• continue communications with you about the subject of your enquiry;
• keep a reasonable record of our correspondence;
• understand the needs and interests of organisations engaging with the Cultural Data Trust; and
• follow up where you have asked us to do so.

We will not use information submitted through the Contact Us form for unrelated marketing unless there is an appropriate lawful basis to do so.

If you separately and explicitly ask to receive general updates, we may use your contact details for that purpose in accordance with section 8 below.

5. Special category and sensitive information

We do not ask website visitors to provide special category personal data through our general contact form.

Please do not include unnecessary sensitive personal information in an enquiry.

If we need to collect or use special category personal data for a specific activity, we will identify an appropriate lawful basis and any additional condition required by law.

6. Why we use personal information

We may use personal information to:

• respond to enquiries and requests;
• maintain communications with people and organisations who contact us;
• provide information about the Cultural Data Trust and its work;
• respond to questions about our work, data access and future options where we are able to do so;
• manage relationships with cultural organisations, funders, researchers, public bodies, suppliers, advisers and partners;
• understand interest in our mission and future services;
• organise meetings, events, consultations and sector engagement;
• administer requests to receive updates;
• operate, protect and improve our website;
• measure website usage through Google Analytics where consent has been given;
• maintain security and diagnose technical problems;
• comply with legal, regulatory, governance and accounting obligations; and
• establish, exercise or defend legal claims.

7. Our lawful bases

Depending on the activity, we may rely on:

Legitimate interests

Where it is necessary for our legitimate interests, or those of another organisation, and those interests are not overridden by your rights and interests. This may include responding to enquiries, maintaining professional relationships, following up on communications, improving our services and keeping appropriate records.

Contract

Where processing is necessary to take steps at your request before entering into a contract, or to perform a contract where applicable.

Legal obligation

Where we need to process information to comply with a legal or regulatory obligation.

Consent

Where we ask for and receive your consent. This includes the use of non-essential analytics cookies on our website.

Where we rely on consent, you can withdraw it at any time.

8. Email updates and direct marketing

If you ask to receive updates from us, we may use your contact details to send relevant news, information or invitations.

Where consent is required, we will ask for it using an unticked opt-in checkbox or explicit request. We do not bundle general updates consent with submission of standard enquiries.

You can stop receiving general updates at any time by using an unsubscribe option where provided or by contacting info@culturaldatatrust.org.

We may still send non-marketing communications where they are necessary, for example in response to an enquiry or in connection with an existing service or contractual relationship.

9. Google Analytics

We use Google Analytics to understand how visitors use our website.

Google Analytics will only be activated where you have given the required consent through our cookie banner.

Google Analytics may use cookies or similar technologies to collect information about website usage. We use this information to understand matters such as:

• which pages are visited;
• how visitors navigate through the site;
• how visitors arrived at the site; and
• how the website performs across devices and browsers.

We use analytics information to improve the website and understand the effectiveness of our communications.

You can change or withdraw your cookie choices at any time through the Cookie Settings control on the website.

Further information about the cookies used is set out in our Cookie Policy.

10. Who we may share information with

We may share personal information where necessary with:

• website, hosting, email, analytics and IT service providers;
• Google, where Google Analytics is enabled with your consent;
• professional advisers, including legal, financial and data-protection advisers;
• suppliers and contractors supporting our operations;
• public bodies, funders, research partners or delivery partners where this is necessary and lawful; and
• regulators, courts, law-enforcement bodies or other authorities where required by law.

We do not sell personal information.

11. International transfers

Some technology suppliers may process personal information outside the United Kingdom.

Where personal information is transferred internationally, we will take appropriate steps required by UK data protection law. Depending on the destination and circumstances, this may include relying on UK adequacy regulations or approved contractual safeguards.

12. How long we keep personal information

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, including any legal, regulatory, contractual, accounting or reporting requirements.

In particular:

• Contact Us enquiries and related correspondence will be retained for as long as needed to respond and maintain a reasonable record of the communication and any resulting relationship.
• Information used for general updates will be retained until you unsubscribe or it is no longer needed.
• Contractual, financial and governance records may be retained for longer periods where required.
• Analytics information is retained in accordance with our Google Analytics configuration and cookie choices.

We will periodically review information and delete or anonymise information that is no longer required.

13. Security

We use appropriate technical and organisational measures to protect personal information against unauthorised or unlawful processing and against accidental loss, destruction, alteration or disclosure.

Measures may include access controls, secure hosting, authentication, backups, monitoring, supplier due diligence and appropriate internal procedures.

14. Your data protection rights

Depending on the circumstances, UK data protection law may give you rights including:

• the right to be informed about how your personal information is used;
• the right to access your personal information;
• the right to have inaccurate information corrected;
• the right to have information erased in certain circumstances;
• the right to restrict processing in certain circumstances;
• the right to object to processing in certain circumstances;
• the right to data portability in certain circumstances;
• rights relating to solely automated decision-making where applicable; and
• the right to withdraw consent where processing is based on consent.

These rights are not absolute and may depend on the circumstances.

To exercise a right, contact info@culturaldatatrust.org.

15. Complaints

If you have concerns about how we use your personal information, please contact us first so that we can try to resolve the matter.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s independent data protection regulator.

Information Commissioner’s Office
Website: https://ico.org.uk/
Telephone: 0303 123 1113

16. Third-party websites

Our website may contain links to websites operated by other organisations.

We are not responsible for the privacy practices of third-party websites. You should review their privacy information when visiting them.

17. Children

The Cultural Data Trust website is primarily intended for organisations, professionals, researchers, policymakers and others interested in cultural data.

It is not designed as an online service directed specifically at children.

18. Changes to this policy

We may update this policy when our activities, services, suppliers or legal obligations change.

The current version will be published on this website and the date at the top will show when it was last updated.

19. Contact