The D-Day Story and Portsmouth City Council are committed to protecting and respecting your privacy.
For the purpose of the General Data Protection Regulation (GDPR) and the Data Protection Act 2018 (the Act), the data controller is Portsmouth City Council of Civic Offices, Guildhall Square, Portsmouth PO1 2AL. The council’s data protection policy is available on the Portsmouth City Council website.
Why we collect and use personal information
The information we collect falls into two categories:
- Information anonymously and automatically tracked that is gathered as visitors navigate through our website and/or subscribe to our email newsletters, share our content on social media or make a donation. This information is collected by a third-party service provider on our behalf.
- Personal information voluntarily supplied by visitors to the website when they register, sign up to receive our updates, participate in interactive activities such as purchasing tickets for entry to the museum or donating to the Portsmouth D-Day Museum Trust. Some of this information is collected by third-party service providers on our behalf.
How we use this information:
- To deliver a contracted service, such as when you purchase tickets for The D-Day Story.
- To carry out our obligations arising from any contracts entered in to with selected third party suppliers (named below).
- To keep those who have subscribed to our mailing list up-to-date with information about the museum, events, goods and services we offer which may be of interest to you and to notify you about any changes to our service.
- To ensure that content from our website is presented in the most effective manner for you and for your computer.
- To administer our site and for internal operations, including troubleshooting, and using anonymised data for analysis, testing, research, statistical and survey purposes.
Who we share information with:
We will never sell your data and will only share your personal information where there is a legally justified and necessary reason to do so. We do use a small number of carefully selected third parties to perform certain functions on our behalf, such our mailing subscription service, website analytics, and to administer ticket sales and donations to the museum.
Examples of the main third parties featured on or linked to by our website include, but are not limited to:
- Google Analytics
- Merlin Tickets
These entities may have access to personal data if needed to perform their functions. If such access is required, the personal data will only be processed by third parties in accordance with our lawful instructions, and we will remain the controller of the data. We only use reputable and vetted firms and have contracts and processes in place that ensure the safe and confidential processing of personal data at all times. They are restricted from using, selling, distributing or altering this data in any way other than to provide the requested services to The D-Day Story.
Further information about how and when we use these third parties, along with their Privacy Policies are detailed below.
- Mailing list subscription
If you choose to sign up to our mailing list, which is administered through our third party processor MailChimp, we will store your information, including your first name, last name, email address and any preferences about how and when you wish to hear from us, on a MailChimp server. Neither we nor MailChimp will ever sell on your details or share them with any other parties, unless we are legally compelled to do so.
If you contact MailChimp directly regarding your subscription to our communications, MailChimp may contact you directly; otherwise, MailChimp will never contact you.
Only authorised MailChimp employees have access to our subscriber list.
We will only ever contact you with your consent and all communications will be via electronic means (e-mail or SMS). You are always free to unsubscribe from our newsletters at any time by using the unsubscribe links contained in any email communications that we send you or by requesting removal via email.
As long as you are signed up to our mailing list we may use MailChimp to send you information about the museum in accordance with your selected mailing preferences.
If you choose to make a donation to The D-Day Story, your donation will be made to and administered by The Portsmouth D-Day Museum Trust, a registered charity (Charity No: 1156976) established by Portsmouth City Council. All of the information you submit as part of your donation to The D-Day Story such as your full name, address, telephone number, email address and bank details will be collected and retained by The Portsmouth D-Day Museum Trust and its Trustees.
- Ticket sales
If you choose to purchase tickets for entry to The D-Day Story through our website, you will be directed to a third party processor Merlinsoft Ltd in order to administer your ticket sale. Merlinsoft Ltd will collect and store your personal details (not your financial details) including your first and last name, the type of ticket being purchased, email address, billing address and the password which you set in order to make an account to track your booking.
Merlinsoft will only use data collected on the Merlin Tickets platform for the sole purpose of administering ticket sales on behalf of The D-Day Story.
We use the secure payment provider WorldPay in order to take your online payment. Worldpay will collect personal financial information if you use credit or debit cards for purchasing tickets via our website. Your financial details are not shared with us or retained on our database.
- Improvement and optimisation of our site
To opt out of being tracked by Google Analytics across all websites visit: http://tools.google.com/dlpage/gaoptout.
Where we store your personal data
All information you provide to us is stored on our secure servers. Any payment transactions will be encrypted [using SSL technology]. Where we have given you (or where you have chosen) a password which enables you to access certain parts of our site, you are responsible for keeping this password confidential. We ask you not to share a password with anyone.
Although we will do our best to protect your personal data by using the technologies described above, we cannot completely guarantee the security of your data transmitted over the internet and any transmission is therefore at your own risk.
How long we hold personal information
Records will be kept for no longer than necessary. Ticketing information will be destroyed after two years of an individual’s first visit – if they have not returned since. The museum’s email mailing list will be retained indefinitely, but subscribers are able to unsubscribe at any time and you will be reminded of your right to unsubscribe from our updates in every communication you receive from us. In this instance, data will be removed immediately.
For further information about how long we keep the records we work with, what we do with them at the end of that time, and the reasons why we do those things, you can view Portsmouth City Council’s corporate retention schedule here.
Use of CCTV
CCTV is in operation throughout the museum for the prevention and detection of crime and to monitor the safety and security of our visitors, staff, artefacts, merchandise, and events.
You have the right to see CCTV images of yourself and be provided with a copy. For further information and details of exceptions, see the Council’s Community Safety and CCTV page.
Under the Data Protection Act 2018, you have the right to request access to all of the personal information that we hold about you. Under certain circumstances, you also have rights to:
- Request correction of your personal data.
- Request erasure of your personal data.
- Object to processing of your personal data.
- Request restriction of processing your personal data.
- Request the transfer of your personal data.
- Right to withdraw consent.
If you wish to exercise any of the rights set out above, please contact:
Data Protection Officer
Portsmouth City Council
Telephone: 023 9268 8482
Portsmouth City Council’s general Data Protection privacy notice contains further information about how the Council collects and uses personal information.
If you would like to discuss anything in this privacy notice, or if you have a concern about the way we are collecting or using your personal data, please contact the City Council’s Data Protection Officer in the first instance, as per the contact details above.