York Archaeology Data Privacy Policy

This document sets out the details of the privacy policy of York Archaeological Trust and its subsidiaries.

York Archaeological Trust is committed to protecting and respecting your privacy and this policy will explain what data we collect from you, why we collect it, the way in which we collect it and how it is stored securely

Who are we?

York Archaeological Trust for Excavation and Research Limited is a registered Charity in England & Wales (No. 509060) and Scotland (SCO42846). It is a Company Limited by Guarantee and registered in England No. 143081.

York Archaeology is the trading name of York Archaeological Trust for Excavation & Research Ltd and its subsidiary company JVC Retail Ltd.  This policy applies to all elements of York Archaeology.

How you can contact us

Any questions you may have regarding your privacy and this privacy policy can be submitted to York Archaeological Trust via the following ways*:

Email: [email protected]
Telephone: 01904 663000
Post: York Archaeological Trust, 47 Aldwark, York YO1 7BX (Registered Office)

*Please note normal working office hours are Monday – Friday. 09:00-17:00

The accuracy of your information is important to us. If you change email address, or any of the other information we hold on you is inaccurate or out of date, please contact us using one of the above methods

How do we collect information from you?

We obtain information about you when you:

  1. Register to receive one of our monthly e-newsletters. This can be done online via our websites; when pre-booking a ticket to one (or more) of our visitor attractions and events; on one of our exit research modules at our visitor attractions and at one of our visitor attraction admission desks when purchasing a ticket. In all circumstances, we will endeavor to do this in the most transparent way possible.
  2. Agree to take part in photography / video that is being used in York Archaeological Trust and subsidiaries marketing material.
  3. Make a purchase online, with our box office and at our visitor attraction admissions and retail areas.
  4. Enroll to volunteer with York Archaeological Trust.
  5. Make a donation and/or agree to gift aid.
  6. Receive first aid or emergency assistance on one of our premises.
  7. Donate an object or archive material to us.
  8. Supply a service to York Archaeological Trust or York Archaeological Trust supplies a service to you.
  9. Become a Member of York Archaeological Trust.

We are concerned to protect the privacy of children aged 16 or under. If you are aged 16 or under‚ please get your parent/guardian’s permission beforehand whenever you provide us with personal information.

What information we collect about you and why

We will only ever collect the information we need – including data that will be useful to help improve our services. We collect two kinds of information:

  1. Non-personal information such as IP addresses (the location of the computer on the internet), pages accessed and files downloaded. This information doesn’t tell us anything about who you are or where you live, it just helps us determine how many people use our websites, how many people visit on a regular basis, and how popular our pages are allowing us to monitor and improve our service.
  2. Personal information such as name, postal address, phone number, email address, date of birth (where appropriate), payment details, information about your interests and hobbies etc.

How is your information used?

We only use the information for the purpose it is given and nothing else. It is retained for only the minimum period of time appropriate to the circumstance and not shared with anyone outside York Archaeological Trust unless required to by law.

We may use your information to:

  1. Send you communications which you have requested and that may be of interest to you. These may include information about campaigns, exhibition updates, events, fundraising activities etc.
  2. Process a donation you have made.
  3. Process a payment you have made.
  4. If you are a UK taxpayer and have agreed to ‘gift aid’ your admission fee and/or donation to one or more of our visitor attractions, we need to ask for your name, address and postcode in order for us to make a claim to HMRC.
  5. Contact you if you have taken part in one of our competitions and you have won a prize.
  6. Seek your views or comments on the services we provide or are responding to a comment you have submitted to us.
  7. Notify you of any changes to a service, event or product we provide.
  8. Carry out our obligations arising from any contracts entered into by you and us.
  9. Process a volunteer application, in which case we may ask for your personal details and information of any medical conditions which we need to be aware of for health and safety reasons. If your role involves working with minors, you will have to undertake a DBS check.
  10. Contact emergency contacts in the event of an emergency if you are a volunteer or employee.

Who has access to your information?

Your information will only be accessed by employees of York Archaeological Trust and only those who have a specific reason to do so. Under new data protection guidelines, we are allocating for each data type we hold, a ‘Processor’ and a ‘Controller’. This way we know who within York Archaeological Trust is responsible for managing and handling your data should we be required to disclose this.

As previously mentioned, we will never sell or share your information with third parties for marketing purposes.

We may need to pass your data to third parties who are acting on our behalf in order to complete a service to you, thereby acting as the ‘Controller’. These include but are not limited to:

1. Worldpay
When you are using our secure online payment pages, our e-commerce site, payment over the telephone or in person, your payment is processed by Worldpay, who specialise in the secure online capture and processing of credit/debit card transactions. If you have any questions regarding secure transactions, please contact them at www.worldpay.com.

2. Sage
When entering into a contract with York Archaeological Trust to either provide or receive a service, your details, including payment and contact, will be handled by SAGE UK. For more information on SAGE please visit www.sage.com.

3. Google
York Archaeological Trust uses the Google Mail platform to host its email system. All email correspondence between you and York Archaeological Trust will be managed by Google. For more information on Google Mail please visit www.google.com/gmail.

4. Third Party Email Marketing Software
York Archaeological Trust supplies e-newsletters to databases who have opted-in to receive this type of communication to their email. In order for York Archaeological Trust to do this in an efficient manner, we use a series of email marketing suppliers (TT-Mail and Survey Monkey). For more information on these providers please visit www.tech-trust.org/tt-mail/ and www.surveymonkey.com

How we keep your information secure

We have taken steps to ensure that the personal data we have on file is, where possible, kept on digital servers under password protection, rather than in paper-format stored in locked cabinets and offices. This allows us to access what data we have on you more quickly, should you ask us to retrieve it.

We are currently in the process of updating all our websites to have an SSL certificate. This is evident by a lock symbol appearing to the left of the website address in your website browser.

However should a data breach occur, we will abide with the Information Commissioner’s Office and report this within 72 hours of the breech occurring.

We will provide training on the new GDPR regulations to all relevant staff and Trustees of York Archaeological Trust.

How long we keep your data on file

We will only keep personal information for the minimum period it is necessary to do so. Our current storage times are:

1. Volunteers
Data is kept on a secure file but is destroyed six years after last being actively involved with York Archaeological Trust.

2. Suppliers
Data is kept on a secure file but is destroyed 7 years after the date of your last transaction with us. Paper copies of invoices, credit notes and statements containing personal data (name, address and bank details) are kept securely and destroyed after 7 years.

3. Marketing Databases
Your chosen method of communication, whether this is email, telephone number or postal address, will be kept indefinitely on the appropriate platform. We may occasionally contact you to ask you if the details we have on file are the most up to date. You can opt-out of receiving marketing communication by either contacting us using the methods stated at the start of this policy or if you receive emails from us, by the ‘opt-out’ button clearly marked at the top and bottom of those emails.

4. Gift Aid
We are obliged to keep gift-aid records for seven years

Use of ‘Cookies’

Our websites use cookies, a small file which asks permission to be placed on your computer’s hard drive. Once you agree, the file is added and the cookie helps analyse web traffic or lets you know when you visit a particular site. Cookies allow web applications to respond to you as an individual. The web application can tailor its operations to your needs, likes and dislikes by gathering and remembering information about your preferences.

In general, we use cookies and our records of the pages users have visited to gather information about all of our users collectively, such as what areas users visit more frequently and what services are accessed the most. We only use such data in the aggregate. This information helps us to determine what is most beneficial for our users, and how we can continually create a better overall experience for our users and improve our website in order to tailor it to customer needs.

Overall, cookies help us provide you with a better website, by enabling us to monitor which pages you find useful and which you do not. A cookie in no way gives is access to your computer or information about you, other than the data you choose to share with us.

Links to other websites

Our website may contain links to other websites run by other organisations. This privacy policy applies only to websites owned by York Archaeological Trust‚ so we encourage you to read the privacy statements on the other websites you visit. We cannot be responsible for the privacy policies and practices of other sites even if you access them using links from one of our websites.

In addition, if you linked to one of our websites from a third party site, we cannot be responsible for the privacy policies and practices of the owners and operators of that third party site and recommend that you check the policy of that third party site.

Review of this Policy

We keep this Policy under regular review. This Policy was last updated in September 2023.