Privacy statement

The D-Day Story and Portsmouth City Council are committed to protecting and respecting your privacy.

This policy, together with our terms of use and any other documents referred to on it, sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by us. Please read the following carefully to understand our views and practices regarding your personal data and how we will treat it. By visiting this website you are accepting and consenting to the practices described in this policy.

For the purpose of the General Data Protection Regulation (GDPR) and the Data Protection Act 2018 (the Act), the data controller is Portsmouth City Council of Civic Offices, Guildhall Square, Portsmouth PO1 2AL. The council’s data protection policy is available on the Portsmouth City Council website.


Our website uses cookies to distinguish you from other users of our website. This helps us to provide you with a good experience when you browse our website and also allows us to improve our site. For detailed information on the cookies we use and the purposes for which we use them see the council’s cookie policy.

Why we collect and use personal information

The information we collect falls into two categories:

  1. Information anonymously and automatically tracked that is gathered as visitors navigate through our website and/or subscribe to our email newsletters, share our content on social media or make a donation. This information is collected by a third-party service provider on our behalf.
  2. Personal information voluntarily supplied by visitors to the website when they register, sign up to receive our updates, participate in interactive activities such as purchasing tickets for entry to the museum or donating to the Portsmouth D-Day Museum Trust. Some of this information is collected by third-party service providers on our behalf.

How we use this information:

  • To deliver a contracted service, such as when you purchase tickets for The D-Day Story.
  • To carry out our obligations arising from any contracts entered in to with selected third party suppliers (named below).
  • To keep those who have subscribed to our mailing list up-to-date with information about the museum, events, goods and services we offer which may be of interest to you and to notify you about any changes to our service.
  • To ensure that content from our website is presented in the most effective manner for you and for your computer.
  • To administer our site and for internal operations, including troubleshooting, and using anonymised data for analysis, testing, research, statistical and survey purposes.

Who we share information with:

We will never sell your data and will only share your personal information where there is a legally justified and necessary reason to do so. We do use a small number of carefully selected third parties to perform certain functions on our behalf, such our mailing subscription service, website analytics, and to administer ticket sales and donations to the museum.

Examples of the main third parties featured on or linked to by our website include, but are not limited to:

  • Google Analytics
  • Merlin Tickets
  • MailChimp
  • WorldPay

These entities may have access to personal data if needed to perform their functions. If such access is required, the personal data will only be processed by third parties in accordance with our lawful instructions, and we will remain the controller of the data. We only use reputable and vetted firms and have contracts and processes in place that ensure the safe and confidential processing of personal data at all times. They are restricted from using, selling, distributing or altering this data in any way other than to provide the requested services to The D-Day Story.

Further information about how and when we use these third parties, along with their Privacy Policies are detailed below.

  • Mailing list subscription

If you choose to sign up to our mailing list, which is administered through our third party processor MailChimp, we will store your information, including your first name, last name, email address and any preferences about how and when you wish to hear from us, on a MailChimp server. Neither we nor MailChimp will ever sell on your details or share them with any other parties, unless we are legally compelled to do so.

If you contact MailChimp directly regarding your subscription to our communications, MailChimp may contact you directly; otherwise, MailChimp will never contact you.

Only authorised MailChimp employees have access to our subscriber list.

We will only ever contact you with your consent and all communications will be via electronic means (e-mail or SMS). You are always free to unsubscribe from our newsletters at any time by using the unsubscribe links contained in any email communications that we send you or by requesting removal via email.

As long as you are signed up to our mailing list we may use MailChimp to send you information about the museum in accordance with your selected mailing preferences.

Whilst MailChimp data is held on servers in the USA, they are part of the EU-U.S Privacy Shield and are therefore compliant with the EU data protection regulations. For more information, you can view MailChimp’s Privacy Policy here.

  • Donations

If you choose to make a donation to The D-Day Story, your donation will be made to and administered by The Portsmouth D-Day Museum Trust, a registered charity (Charity No: 1156976) established by Portsmouth City Council. All of the information you submit as part of your donation to The D-Day Story such as your full name, address, telephone number, email address and bank details will be collected and retained by The Portsmouth D-Day Museum Trust and its Trustees.

  • Ticket sales

If you choose to purchase tickets for entry to The D-Day Story through our website, you will be directed to a third party processor Merlinsoft Ltd in order to administer your ticket sale. Merlinsoft Ltd will collect and store your personal details (not your financial details) including your first and last name, the type of ticket being purchased, email address, billing address and the password which you set in order to make an account to track your booking.

Merlinsoft will only use data collected on the Merlin Tickets platform for the sole purpose of administering ticket sales on behalf of The D-Day Story.

Merlinsoft Ltd is registered in the UK. For more information, you can view Merlinsoft’s Privacy Policy here.

We use the secure payment provider WorldPay in order to take your online payment. Worldpay will collect personal financial information if you use credit or debit cards for purchasing tickets via our website. Your financial details are not shared with us or retained on our database.

WorldPay (UK) is registered in the UK. For more information please see Worldpay’s Privacy Policy here.

  • Improvement and optimisation of our site

When you visit, we use a third party service, Google Analytics, which uses cookies to collect anonymised internet log information and details of visitor behaviour patterns. We do this to find out insights such as the number of visitors to the various parts of the site and so that we can continually work to improve the site and your experience of it. This information is only processed in a way which does not identify anyone. We do not make, and do not allow Google to make, any attempt to find out the identities of those visiting our website.

Google’s Privacy Policy.

To opt out of being tracked by Google Analytics across all websites visit:

Where we store your personal data

Portsmouth City Council will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this privacy policy.

All information you provide to us is stored on our secure servers. Any payment transactions will be encrypted [using SSL technology]. Where we have given you (or where you have chosen) a password which enables you to access certain parts of our site, you are responsible for keeping this password confidential. We ask you not to share a password with anyone.

Although we will do our best to protect your personal data by using the technologies described above, we cannot completely guarantee the security of your data transmitted over the internet and any transmission is therefore at your own risk.

How long we hold personal information

Records will be kept for no longer than necessary. Ticketing information will be destroyed after two years of an individual’s first visit – if they have not returned since. The museum’s email mailing list will be retained indefinitely, but subscribers are able to unsubscribe at any time and you will be reminded of your right to unsubscribe from our updates in every communication you receive from us. In this instance, data will be removed immediately.

For further information about how long we keep the records we work with, what we do with them at the end of that time, and the reasons why we do those things, you can view Portsmouth City Council’s corporate retention schedule here.

Use of CCTV

CCTV is in operation throughout the museum for the prevention and detection of crime and to monitor the safety and security of our visitors, staff, artefacts, merchandise, and events.

You have the right to see CCTV images of yourself and be provided with a copy. For further information and details of exceptions, see the Council’s Community Safety and CCTV page.

Your rights

Under the Data Protection Act 2018, you have the right to request access to all of the personal information that we hold about you. Under certain circumstances, you also have rights to:

  • Request correction of your personal data.
  • Request erasure of your personal data.
  • Object to processing of your personal data.
  • Request restriction of processing your personal data.
  • Request the transfer of your personal data.
  • Right to withdraw consent.

If you wish to exercise any of the rights set out above, please contact:

Data Protection Officer
Portsmouth City Council
Civic Offices,
Telephone: 023 9268 8482

Further Information

Portsmouth City Council’s general Data Protection privacy notice contains further information about how the Council collects and uses personal information.

If you would like to discuss anything in this privacy notice, or if you have a concern about the way we are collecting or using your personal data, please contact the City Council’s Data Protection Officer in the first instance, as per the contact details above.

Changes to our privacy policy

Any changes we make to our privacy policy in the future will be posted on this page and, where appropriate, notified to you by e-mail. Please check back frequently to see any updates or changes to our privacy policy. This privacy notice was last updated on 2 August 2018.