Data Privacy Notice
Policy statement
Plas Gunter Mansion Trust respects your right to privacy and follows data protection regulations.
This data privacy notice explains how and why we collect, process, retain, store and share your information, and outlines your rights. It will be kept under review and will be updated when necessary.
About Plas Gunter Mansion Trust
In this notice, references made to ‘PGMT’, ‘our’, ‘we’, and ‘us’ relate to Plas Gunter Mansion Trust. PGMT is the data controller and decides how your personal data is processed and for what purposes.
PGMT owns Plas Gunter Mansion. The Trust is committed to restoring the 17th century Plas Gunter Mansion and bringing it back to life. It is a Building Preservation Trust using Architectural Heritage Fund and Charity Commission approved Memorandum and Articles of Association. It is a company limited by guarantee (7705089) and a registered charity (1144813). Further details about Plas Gunter Mansion Trust can be found at www.plasguntermansion.org.uk
If you have any questions, please use the website contact form www.plasguntermansion.org.uk/contact or write to us at Plas Gunter Mansion, 39a Cross Street, Abergavenny, Monmouthshire, NP7 5ER.
Data collection
Personal data
The Information Commissioner’s Office states ‘Personal data only includes information relating to natural persons who: can be identified or who are identifiable, directly from the information in question; or who can be indirectly identified from that information in combination with other information.’
The personal data that we collect may include your name, title, physical address, postcode, email address, telephone numbers, job title, demographic and geographic information, image, other personal and non-personal information you provide, and details of your interactions with us or involvement in our exhibitions and events. The aggregation of this information may generate further personal data, such as building profiles to enable us to engage with you about your specific areas of interest and provide you with relevant communications.
PGMT and third-party information technology providers may also collect personal data (including cookies, online identifiers and location data) as you interact with our website and other digital channels.
Special category data
The Information Commissioner’s Office identifies examples of special category data such as race, ethnic origin, politics, religion, trade union membership, genetics, biometrics, health, sex life, or sexual orientation.
We may need to collect special category data on occasion, for example to help us monitor equal opportunities or for reporting to funding bodies. This data will be aggregated, individuals will not be identified.
Volunteers
We may need to collect additional information about volunteers for insurance, legal, management, and safeguarding reasons. This may include references, background checks, and details of emergency contacts.
Photographs, audio and video recording
Wherever possible, we will seek your consent to use your image in photographs and your voice and image in audio and video recordings. Attendance at conferences, fundraising, other events, and volunteering activities could result in your image and voice being captured, stored and used in all and any media.
PGMT reserves the right to use closed circuit television (CCTV) and other recording technologies for security and safety purposes at Plas Gunter Mansion and you may be recorded when you visit, supply or provide services, undertake volunteering or other activities. Notices will indicate when footage is being recorded.
Purposes of the processing
We will only process your data on the grounds permitted by the relevant regulations, in pursuance of our aims and for the management of our activities, operations and services.
The way we use this data will depend on the purpose and type of interaction with us, examples are provided in the table below (this is not an exhaustive list, it will be kept under review and will be updated over time).
Whose data? Attendees at conferences, fundraising and other events. [Note: For attendees consenting to newsletter subscription, please see ‘Newsletter subscribers’ below.]
What data? Personal data (including name and contact details), donation / payment information, and any other information provided (such dietary requirements or content provided in feedback forms).
How will it be used? To communicate (for example, to book and confirm places, to provide information about other events, and to suggest ways to get involved), to deliver our events, to record attendance, process donations / payments towards the cost of the event, and for the purposes of Gift Aid where applicable.
Whose data? Children and young people [Note: Children and young people should always ask a parent / guardian / teacher for permission before sending personal or special category data to anyone online.]
What data? We do not knowingly collect or store data about children and young people. Should this position change in the future, this notice will be updated.
Whose data? Contractors, professional advisors, and other providers of goods and services
What data? Personal data (including name, job title, and contact details) and any other information provided.
How will it be used? To communicate (for example, to instruct the third party to carry out works or provide goods or services) and to fulfil any contractual and legal obligations and responsibilities.
Whose data? Donors: gifts in wills
What data? Personal data (including name and contact details), gift information, any conditions, and any other information provided. Special category data may also be collected if there is a clear reason for doing so.
Personal data may be collected on co-beneficiaries, executors, solicitors, trustees and any other parties involved in estate administration.
How will it be used? To communicate (for example, if a donor is considering leaving a gift in their will, to send meeting invitations and information about projects), and to liaise with individuals and organisations involved in estate administration. To record the nature and amount of the gift, to acknowledge the gift in the media (should we have consent to do so), and to process the gift.
Whose data? Donors: major gifts
What data? Personal data (including name and contact details), gift information, any conditions, and any other information provided.
How will it be used? To communicate (for example, to thank the donor, to send meeting invitations and information about projects), to record the nature and amount of the gift, to acknowledge the gift in the media (should we have consent to do so), to process the gift, and for the purposes of Gift Aid where applicable.
Whose data? Donors: one-off donations, including crowdfunding, Raisely and Stripe.
What data? Personal data (including name and contact details), donation information, and any other information provided.
Raisely is used as a fundraising platform and Stripe is the payment gateway used by Raisely. Data transferred to either Raisely or Stripe will be subject to the privacy policies of these companies.
How will it be used? To communicate (for example, to thank the donor), record the nature and amount of the donation, process the donation, and for the purposes of Gift Aid where applicable.
Whose data? Donors: regular donations
What data? Personal data (including name and contact details), donation information, and any other information provided.
Raisely is used as a fundraising platform and Stripe is the payment gateway used by Raisely. Data transferred to either Raisely or Stripe will be subject to the privacy policies of these companies.
How will it be used? To communicate (for example, to thank the donor), record the nature and amount of the donation, process the donation, and for the purposes of Gift Aid where applicable.
Whose data? Funding bodies
What data? Personal data about board members, trustees and administrators (including name, job title and contact details) and any other information provided.
How will it be used: To communicate with (for example, to thank the funding body and to report on how we have used the funding) and to acknowledge the funding contribution in the media (should we have consent to do so).
Whose data? Fundraisers in support of our cause
What data? Personal data (including name and contact details), information about the proposed fundraising activity, and any other information provided.
How will it be used? To communicate, to promote the fundraiser’s efforts in the media (should we have consent to do so), and to process related donations.
Whose data? Guest exhibitors and guest volunteers
[Note: PGMT accepts no responsibility or liability for guest exhibitions and guest volunteers. All matters remain the responsibility of the guest exhibitor, including data privacy.]
What data? Personal data (including name and contact details) and any other information provided.
We do not collect personal data on guest volunteers.
How will it be used? To communicate (for example, to make arrangements for the exhibition and to provide induction materials for guest volunteers), to share information with specific consent (for example, to respond to queries or requests for information), and to promote the exhibition.
Whose data? Lenders of equipment and display materials
What data? Personal data (including name and contact details) and any other information provided.
How will it be used? To communicate (for example, to arrange for the collection and return of items) and to record the details of the items held by us.
Whose data? Members and Founders
What data: Personal data (including name and contact details), donation information, and any other information provided.
Raisely is used as a fundraising platform and Stripe is the payment gateway used by Raisely. Data transferred to either Raisely or Stripe will be subject to the privacy policies of these companies.
How will it be used? To communicate (for example, to thank the member), record the nature and amount of the membership fee, process the membership fee, and for the purposes of Gift Aid where applicable.
Whose data? Newsletter subscribers
What data? Personal data (including name and email address).
MailChimp is used as a marketing automation platform and data transferred will be subject to its privacy policy.
How will it be used? To communicate (for example, to send email newsletters and other circulars relevant to the project, to send invitations to events, and to suggest ways to get involved which could include donations and gifts, fundraising activities, research, volunteering and other opportunities).
Whose data? Project group members
What data? Personal data (including name, contact details, and demographic information), special category data, and any other information provided by the project group member.
How will it be used? To communicate (for example, to send agenda and other documents), to administer participation (for example, for the purposes of appointment, equal opportunities monitoring, maintaining details of skills and special interests / responsibilities, recording attendance, and recording contributions at meetings), to share information with specific consent (for example, to respond to queries or requests for information), and to obtain opinions and suggestions.
Whose data? Purchasers of merchandise or other goods and services
We only accept cash or cheque payments at Plas Gunter Mansion currently and no personal data is required but this may change if electronic transactions are permitted in the future. Should this position change in the future, this notice will be updated.
Whose data? Researchers
What data? Personal data (including name and contact details) and any other information provided (potentially including information relating to other natural persons).
How will it be used? To communicate (for example, to make or respond to queries, to share research related to our aims, to send invitations to events, and to suggest ways to get involved).
Whose data? Senders of contact forms and emails, and general enquiries
What data? Personal data (including name and contact details) and any other information provided.
How will it be used? To communicate (for example, to respond to queries or requests for information) and obtain opinions and suggestions.
Whose data? Social media users (including Facebook, Instagram and TikTok)
What data? Personal data (including name and username) and any other information provided.
By accessing social media, the data transferred will be subject to the social media company’s privacy policy.
How will it be used? To communicate (for example, to respond to queries or requests for information) and to obtain opinions and suggestions.
Whose data? Visitors
[Note: Depending on the nature of the interaction, please also see ‘Newsletter subscribers’, ‘Purchasers of merchandise’, ‘Researchers’, and ‘Senders of contact forms and emails, and general enquiries’ above.]
What data? We do not routinely capture data about visitors to Plas Gunter Mansion. However, for those wishing to complete an entry in the guest book, we may collect and store personal data (including name, general location or postcode, and any comments) and any other information provided by the visitor.
How will it be used? To record the visit and to obtain opinions and suggestions.
Whose data? Volunteers
[Notes: For volunteers consenting to newsletter subscription, please see ‘Newsletter subscribers’ above; For guest volunteers, please see ‘Guest exhibitors and guest volunteers’ above.]
What data? Personal data (including name, contact details, and demographic information), special category data (including health issues), and any other information provided by the volunteer (including availability for shifts). Personal data (including name and contact details) may be collected on next-of-kin or other individuals for the purposes of emergency contact.
How will it be used? To communicate (for example, to arrange shifts in the exhibition space or to acknowledge contributions made), to manage volunteering (for example, for the purposes of recruitment, equal opportunities monitoring, maintaining details of skills and special interests, health and wellbeing needs, training and development, recording shifts, processing expenses claims, appraisals, disciplinary matters), to share information with specific consent (for example, to respond to queries or requests for information), and to obtain opinions and suggestions.
Whose data? Website users
[Notes: For website users consenting to newsletter subscription, please see ‘Newsletter subscribers’ above; Links within the PGMT website to other websites are not covered by this data privacy notice, we do not accept any responsibility or liability for other websites.]
What data? IONOS is used as a website content management system, alongside other technologies, which collect personal data (including cookies, online identifiers, and location data).
How will it be used? To manage online resources (for example, to enable access to website content, to personalise content, and for social media features) and to analyse associated statistics.
On occasion we will undertake analysis, conduct surveys and invite feedback from the individuals and groups that we interact with in order to collect information and/or opinions and suggestions.
We may use this information to inform and improve our activities, operations and services. We may also invite you to provide special category data (for example, ethnic origin) to help us monitor equal opportunities or for reporting to funding bodies. This data will be aggregated, individuals will not be identified.
Lawful basis for the processing
The Information Commissioner’s Office identifies that ‘The lawful bases for processing are set out in Article 6 of the GDPR (General Data Protection Regulation). At least one of these must apply whenever you process personal data:
Consent: the individual has given clear consent for you to process their personal data for a specific purpose.
Contract: the processing is necessary for a contract you have with the individual, or because they have asked you to take specific steps before entering into a contract.
Legal obligation: the processing is necessary for you to comply with the law (not including contractual obligations).
Vital interests: the processing is necessary to protect someone’s life.
Public task: the processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law.
Legitimate interests: the processing is necessary for your legitimate interests or the legitimate interests of a third party unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests.
PGMT use the following bases for the processing: consent (for example, in relation to people subscribing to newsletters and other circulars); contract (for example, for the purposes of fulfilling our obligations and responsibilities to contractors, professional advisors, and other providers of good and services); legal obligation (for example, for the purposes of fulfilling our obligations and responsibilities to funding bodies and in relation to Gift Aid); and legitimate interests (for example, in pursuance of our aims and for the management of our activities, operations and services).
Data retention
We will retain personal and special category data for as long as is necessary for the purposes it was collected.
The retention period will depend on the nature of the data collected and its usage (for example: if a newsletter subscriber withdraws their consent to receive information, their personal data will be destroyed; if a donor makes a Gift Aid declaration, their personal data be retained for up to six years after the calendar year of the declaration).
Storing and securing information
We take data protection seriously and we will take reasonable precautions to protect your information. Storage of data is kept to a minimum and is securely destroyed when it is no longer needed.
PGMT has finite resources and we are dependent on the security measures within the various systems we use to collect, process, share and store information. In addition to IONOS, MailChimp, Raisely, Stripe, and other technologies, we may also use DropBox, Google Docs, OneDrive, and other cloud storage solutions.
Where project group members are assigned coordinator roles, they may store limited information on their own systems in the course of delivering their duties and responsibilities.
We may communicate by email, in unencrypted form. Whilst we endeavour to protect your information, PGMT cannot guarantee that all communications and systems will be fully secure and free from viruses or other harmful effects.
Sharing and disclosing information
We do not buy or sell personal information. We will only share your information where it is necessary or where we are required to do so (for example, for insurance, legal, management, and safeguarding reasons).
Personal and special category data is accessed and shared internally on a need to know basis. PGMT cannot bear responsibility for unauthorised access, misuse, and disclosure of information.
In certain circumstances, we may share personal data with:
- Third parties, such as information technology providers, contractors, professional advisors, and other providers of goods and services (for example, for the effective delivery of systems and in the management of our activities, operations and services).
- Appropriate authorities including HMRC, law enforcement agencies, and other parties where we have a legal obligation (for example, for the detection and prevention of fraud).
Rights available to individuals
The Information Commissioner’s Office identifies that ‘The GDPR provides the following rights for individuals:
- The right to be informed
- The right of access
- The right to rectification
- The right to erasure
- The right to restrict processing
- The right to data portability
- The right to object
- Rights in relation to automated decision making and profiling.’
The lawful basis for processing can affect which rights are available to individuals.
Where consent has been given for PGMT to use your personal data, you have the right to withdraw that consent at any time. You also have the right to ask us to stop sending you email newsletters and other circulars; such communications often include an ‘unsubscribe’ link.
If you wish to exercise your rights, please use the website contact form www.plasguntermansion.org.uk/contact or write to us at Plas Gunter Mansion, 39a Cross Street, Abergavenny, Monmouthshire, NP7 5ER. We may ask you for further information, including proof of identity.
If you wish to lodge a complaint, please contact us directly but you also have the right to contact the Information Commissioner’s Office www.ico.org.uk/make-a-complaint.
