Arts Facilities and Galleries

1. The purpose for which we use your personal data

The information we collect about you will be used for the purposes of:

• Enabling us to maintain, develop, research and deliver a programme of exhibitions, formal, informal educational activities and events.
• Purchasing goods and services and engaging artists, makers, designers, performers and educators to deliver our service.

The legal basis for the processing of personal data in relation to these purposes is to exercise our authority under Section 12 of the Public Libraries and Museums Act 1964, under which the Council has a discretionary power to maintain museums and art galleries.

We also communicate with our customers to let you know about our exhibitions and events through marketing emails.  We also ask you to help us improve our service by taking part in research and customer surveys.  We contact you in this way based on your consent and you can withdraw this at any time by emailing us.

2. What type of information do we use?

We collect the following types of personal data about you to deliver this service:

Artists, makers, designers, performers and educators:

• Name
• Address
• Email address
• Telephone number
• Bank/payment details

We also need a Disclosure & Barring Service (DBS) check where you work with children or vulnerable adults.

Volunteers:

• Name
• Address
• Email address
• Telephone number
• Information about next of kin

Our customers:

• Name
• Address
• Email address
• Telephone number
• Bank/payment details

3. Do we use information received from other sources?

As we’ve explained above, we do receive information from the DBS if you work with children and vulnerable adults in our galleries. A DBS check will include the following information:

• Name
• Date of birth
• Whether there are any relevant criminal convictions

We process this information about criminal convictions for reasons of substantial public interest, on the basis of this legislation referred to above.

4. Transferring your information abroad

We use a third party called MailChimp to send marketing emails to our customers and they are based in the United States of America.  

The company participates in and has certified its compliance with the Privacy Shield framework, and is committed to treating all personal data received from European Union member countries in accordance with the Privacy Shield framework’s principles.

We use Microsoft Office 365 to process our electronic documents under the terms of a strict agreement, which safeguards your information. This personal data is hosted on servers outside the UK, but only in EU countries which are subject to the General Data Protection Regulation.

5. Who has access to your information?

When we need to carry out a DBS check, we share your name and contact details with this service.  

Where we organise touring exhibitions, we need to provide other venues with your contact details.

There are also other specific situations where we may be required to disclose information about you, such as:

• Where the Council is required to provide the information by law
• Where disclosing the information is required to prevent or detect a crime
• Where disclosure is in the vital interests of the person concerned

6. How long we will keep your information

We only keep information about artists and customers until the end of the event, exhibition or activity.

We keep personal data contained in financial records for six years, plus the current financial year in accordance with the Council’s Retention Guidelines.

If you are a volunteer, we keep your information for as long as you continue to work with us.

7. Your Data Protection rights

You have the right to:

• Obtain access to the personal data that Carmarthenshire Council is processing about you
• Have any inaccurate or incomplete information rectified (corrected)
• Withdraw your consent to processing, where this is the only basis for the processing
• Make a complaint to the Information Commissioner’s Office (ICO), the independent body in the UK which protects information rights

In some circumstances, you may have the right to:

• Object to the processing of your personal information
• The erasure of your personal data
• Restrict the processing of your personal information
• Data portability

8. Contact details

For more information regarding this privacy notice and your rights, please contact:

Data Protection Officer
Carmarthenshire County Council
County Hall
Carmarthen
SA31 1JP

Email: dataprotection@carmarthenshire.gov.uk

Contact details for the Information Commissioner’s Office along with further guidance on Data Protection legislation can be found on the ICO website .