Inspire Privacy Statement

May 2018

Culture, Learning, and Libraries (Midlands) trading as Inspire is registered as a data controller with the Information Commissioner's Office (registration number: ZA125839).

If you have enquiries about this privacy statement or about use of your personal data, you can contact Inspire’s Data Protection Officer (DPO) at:

Data Protection Officer
Inspire

Nottinghamshire Archives

Castle Meadow Road

Nottingham

NG2 1AG

email: DataProtection@inspireculture.org.uk

This privacy statement tells you what to expect when Inspire collects personal data. It applies to information we collect about:

• visitors to our website

• people who register for library or Inspire membership

• people who register for and use our services

• people who are referred to us by other persons, agencies, organisations

• people who contact us with an enquiry or complaint

• job applicants and our current and former employees

• people who participate in publicity for Inspire

• people who are recorded on CCTV operated by Inspire

Personal data means any data which can be used to identify an individual (such as name and address) and any information that relates to that individual from which they can be identified (for instance, details of the services provided to a particular individual). The following types of personal data may be used: personal contact details such as name, address, phone number, etc.

• personal identifiers such as an NI number

• visual images, personal appearance and behaviour

• personal or professional opinions about an individual

• family details

• employment and education details

• student and pupil records

• lifestyle and social circumstances

• pension or financial activity records

• offences (including alleged offences)

• criminal proceedings, outcomes and sentences

• health details

• racial or ethnic origin

• data concerning a natural person’s sex life or sexual orientation

• trade union membership

• political affiliation

• political opinions

• religious or other beliefs of a similar nature

We may need to use personal data for the following purposes:

• the activities and functions we are contacted to deliver on behalf of Nottinghamshire County Council, the Arts Council, the Education and Skills Funding Agency, the National Archives, and our other funding bodies

• delivering Inspire services including, libraries, learning, arts, archives and cultural activity

• delivering services and support to customers and service users

Data protection law allows us to use or share personal data in any of the following circumstances:

• where we have a contract with you or you have asked us to process your data prior to entering onto a contract;

• we are protecting your vital interests, or those of other persons.

• where Inspire is carrying out a task/function in the public interest, for instance, the library or archive services

• where we have a legitimate need to use information for a specific purpose that does not unjustifiably infringe on your rights or freedoms

• where it is necessary for the performance of a law enforcement task

• when we have your (or your appointed representative’s) consent. For example, you may have indicated your consent on a paper form or on-line form on our web site;

To ensure that the Inspire provides you with an efficient and effective service we will sometimes need to share your information with other parties that support the delivery of the service you may receive.

Personal data will not be shared with an individual or organisation based in any country outside of the European Economic Area (EEA) unless there is express permission to do so following a Data Protection Impact Assessment.

We maintain information in accordance with our retention schedules which specify timescales for how long we hold your information. The law may specify the minimum amount of time we have to retain certain information. Please contact Inspire for more information.

If you have concerns about the use of your personal data by Inspire, or its accuracy, you may contact the Data Protection Officer at the address above.

We will take appropriate steps to make sure we hold records about you in a secure way, including:

• all employees who have access to your personal data or are associated with the handling of that data are obliged to respect the confidentiality of your personal data

• putting in place procedures and technologies to maintain the security of all personal data from the point of collection to the point of destruction.

You have a number of rights in relation to your personal data. Please note that not all rights are automatic and some may not be available in certain circumstances where a lawful exception applies. For instance, this could be because a copy of your personal data may need to be kept or used for the purposes of complying with a legal obligation or for use in legal proceedings or for the prevention or detection of crime.

Your rights Summary Exceptions
Right to find out about the personal data we hold about you and access a copy of it (subject access request) You can ask us whether we hold your personal data and you can request a copy of the information we hold Some of the information requested may be exempt from disclosure. This could be because it relates to another individual, it is subject to legal professional privilege, its disclosure would result in serious harm to someone, it consists of adoption records or another lawful exception applies.
Right to withdraw your consent If you have provided us with consent for use of your data, for instance, marketing purposes, you have the right to withdraw your consent to stop the further use of your data for that purpose. The right to withdraw your consent will only affect future use of your data. It will not affect the validity of any pre-existing use. This right is not available where your data can be used without consent (see section 4 above), for instance, where we are under a legal obligation to use your information or another lawful exception applies.
Right to object to use of your personal data (until 25 May 2018, see below for new right to object after this date) You may object in writing to us explaining why use of your data is likely to cause you unjustifiable damage or distress and what should be done to prevent this This right is not automatic and the use of your personal data for purposes you disagree with may be justified in certain cases even if it causes you some damage or distress
Right to raise a concern or enquiry about use of your personal data Please contact the Data Protection Officer at the above address.
Contact the Information Commissioner's Office For independent advice about data protection, privacy and data sharing issues, or if you are dissatisfied with how we have handled a complaint about use of your data, you can write to the Information Commissioner’s Office at the following address:

Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Or email:
casework@ico.org.uk

Additional rights effective on or after 25 May 2018

Your rights Summary Exceptions
Right to rectification of your personal data You may ask for your personal information to be corrected if information we hold is inaccurate or for incomplete information to be completed. This right may not be available in limited circumstances where a lawful exception applies.
Right to erasure of your personal data (right to be
forgotten)
You can request that some or all of your data be erased where:

• we have no further legitimate use for it

• you have withdrawn your consent for us to use your data (unless we can continue to use your data without consent)

• the law requires its deletion.
This right is not available where a lawful exception applies or where the retention
of the data is necessary for:

• public health purposes

• freedom of expression and information

• public interest archiving or research/statistical purposes.

Right to restriction of use of your personal data You can request that your data:
• is not used in a certain way while we consider any concerns you have about its accurace
• is retained instead of being erased after we have no further use for it
• is retained where it is required for a legal claim
• is not used in a certain way while we consider any objections you have raised about our use of your data for our public functions.
This right is not available where a lawful exception applies or in respect of data being used for:
• the protection of the rights of another person
• reasons of important public interest.
Right to object to the use of your personal data You can object to use of your data:
• for direct marketing purposes;
• for service delivery purposes except to the extent that we have an overriding legitimate reason for use of your data or are using your data for a legal claim
• for research you have consented to take part in.
This right may not be available in limited circumstances where a lawful exception applies.
Right to ask for an automated decision to be reconsidered by a human Where we notify you that a significant decision has been taken about you without any human input, you can request that:
• we reconsider the decision, or take a new decision that is not taken solely by automated means.
This right is not available in respect of data being used on the basis of:
• your explicit consent for the purposes of a contract that you have entered into with us

What information do we collect when you visit our website?

The computers which host our website maintain site logs which include the IP details of all machines accessing our pages. We only use such logs to determine website usage and not as a means of identifying or obtaining information about specific users. Any IP information is treated as strictly confidential and is not published or divulged to any third party.

Registering for online services

How do we use your personal information when you register for an online service?

We collect personal data that you provide to us when you register for an online account. We collect personal data when you apply to access some of our services online. By registering with us online (either in relation to your account or a specific service) you consent that Inspire may process the personal data that we collect from you in accordance with this privacy notice. In general, we will hold your personal data for the purposes of maintaining and operating your account or registration and will use your personal information:

• for the purpose you provided the information for

• to verify your entitlement to access the services you have requested, e.g. verification of your residence in the county.

• where you give specific consent to allow us to be able to communicate and provide information about services appropriate to your needs.

We will retain your information for the period necessary to fulfil the relevant purpose for which it is held and we will also retain any external verification so long as it remains accurate based on the information you provide to us. This will allow us to reuse that information when you register for additional services.

Photographic images

How will we use photographs that identify people?

Images of individuals are treated as personal data. Images of crowds in a public area are not. When taking photographs intended for publication on our website or elsewhere, it is our policy to seek the written permission of any individuals who are photographed. We will respond promptly to any request to remove photographic images and/or personal data from the website where the person making such a request has a right to do so in accordance with their data protection rights.

Links to other websites

How will other websites use your personal data?

This privacy statement does not cover the links within this site linking to other websites. We encourage you to read the privacy statements on other websites you visit.

We keep our privacy statement under regular review. Any changes we may make to our privacy statement in the future will be posted on this page. Please check back frequently to see any updates or changes to our privacy statement. It does not provide exhaustive detail of all aspects of Inspire’s collection and use of personal data. However, we are happy to provide any additional information or explanation needed. Any request for this should be sent to the Data Protection Officer.