GDPR and Privacy Statement

Grampian Hospitals Art Trust Privacy Statement  (July 2020)

We take the protection of your personal data very seriously as we know how important it is to you.  This Privacy Statement explains what data Grampian Hospitals Art Trust (GHAT) collects, how we use it and how you can control it.  This privacy policy also explains how our organisation uses the personal data we collect from you when you use our website.

At all times, the data is handled in accordance with the requirements of the General Data Protection Regulation 2016 and the Privacy Communications Regulations 2003.

We process your data using one of four legal bases:-

  1. Legitimate interest – we collect and process your data as required to conduct our business and provide our services to you, as detailed in the events listed below.
  2. To fulfil or perform the requirements of a contract –where you have entered into a contract with us e.g when you purchase an item on our website
  3. Legal obligation – this is relevant where we have a legal obligation to provide data e.g. sending gift aid details to HMRC for tax purposes.
  4. Explicit consent – in cases where any of the above three basis are not appropriate, we will ask for you explicit consent to process and store your data.

Contents

What we hold

What data do we collect?

How we collect your data

What we do with the data

Our IT systems

Marketing

How long we hold data

Your data protection rights

Cookies

How we use cookies

What types of cookies we use

How to manage cookies

Privacy policies of other websites

Changes to our privacy policy

How to contact us

How to contact the appropriate authority

What we hold

We will never obtain personal data from third parties – only from you directly.  We will then process and hold this data when any of the following events occur:-

  • When you opt to receive emails from us about our events and exhibitions
  • When you become a Friend of Grampian Hospitals Art Trust
  • When you make a purchase on our website
  • When you give your consent as part of our projects within the hospitals
  • When you make a gift aid donation to our charity
  • When you contact us for any other reason by way of email, telephone etc – a record of your contact details may remain within our email, messaging and filing systems.

What data do we collect?

We only store personal data about you that is necessary to provide the documentation and service or carry out the contract that is associated with the above listed events.  This will include some or all of the following information:-

  • name
  • postal address
  • email address
  • bank details provided on gift aid donation forms.
  • telephone number
  • other work and personal contact information as provided by you

How we collect your data

You directly provide GHAT with most of the data we collect. We collect data and process data when you:

  • Register online or place an order for any of our products or services.
  • Voluntarily complete a customer survey or provide feedback on any of our message boards or via email.
  • Use or view our website via your browser’s cookies.

What we do with the data

We only use the personal data that is relevant to providing the documentation and service that is associated with the above events.  All data is processed in the UK by us alone, except in the event of a gift aid donation, where the data is shared with HMRC as part of the UK tax process. GHAT does not transfer your data where it can be used and accessed by third parties for their own use. 

We will store your personal data in some or all of the following places:

  • In our filing system and paper files
  • In Microsoft Word documents on our computer data files
  • In email systems
  • In third party systems such as

GHAT collects your data so that we can:

  • Process your order and manage your account.
  • Email you with special offers on other products and services we think you might like.
  • Gain consent to use artwork and writing on social media or publications

If you agree, GHAT will share your data with our partner companies so that they may offer you their products and services.

  • Mail Chimp, MyDonate or Eventbrite

When GHAT processes your order, we may send your data to, and also use the resulting information from, credit reference agencies to prevent fraudulent purchases.

The Controller and Processor have a Data Protection regime in place to oversee the effective and secure processing of your personal data within the organisation of GHAT itself.

Our IT systems

We have spoken to our email hosting company with regards to their security.  They have provided us with a certification that the data they hold on their servers is being held securely.

Marketing

GHAT would like to send you information about products and services of ours that we think you might like, as well as those of our partner companies.

  • Local and national arts organisations

If you have agreed to receive marketing, you may always opt out at a later date.You have the right at any time to stop GHAT from contacting you for marketing purposes or giving your data to other members of the GHAT Group. If you no longer wish to be contacted for marketing purposes, please contact us.

How long we hold data

We retain your personal data for as long as the data is required to support the events listed above.  You always have the right, however, to have this data deleted from our systems at any point (as explained below).

Your data protection rights

GHAT would like to make sure you are fully aware of all of your data protection rights. Every user is entitled to the following:

The right to access – You have the right to request GHAT for copies of your personal data. We may charge you a small fee for this service.

The right to rectification – You have the right to request that GHAT correct any information you believe is inaccurate. You also have the right to request GHAT to complete the information you believe is incomplete.

The right to erasure – You have the right to request that GHAT erase your personal data, under certain conditions.

The right to restrict processing – You have the right to request that GHAT restrict the processing of your personal data, under certain conditions.

The right to object to processing – You have the right to object to GHAT’s processing of your personal data, under certain conditions.

The right to data portability – You have the right to request that GHAT transfer the data that we have collected to another organization, or directly to you, under certain conditions.

If you make a request, we have one month to respond to you. If you would like to exercise any of these rights, please contact us at our email:

Call us at: grampian.hospitalsarttrust@nhs.net

Or write to us: Grampian Hospitals Art Trust, Art Office, Aberdeen Royal Infirmary, AB25 2ZN

Cookies

Cookies are text files placed on your computer to collect standard Internet log information and visitor behaviour information. When you visit our websites, we may collect information from you automatically through cookies or similar technology

For further information, visit allaboutcookies.org.

How we use cookies

GHAT uses cookies in a range of ways to improve your experience on our website, including:

  • Keeping you signed in
  • Understanding how you use our website

What types of cookies we use

There are a number of different types of cookies, however, our website uses:

  • Functionality – GHAT uses these cookies so that we recognize you on our website and remember your previously selected preferences. These could include what language you prefer and location you are in. A mix of first-party and third-party cookies are used.
  • Advertising – GHAT uses these cookies to collect information about your visit to our website, the content you viewed, the links you followed and information about your browser, device, and your IP address. GHAT sometimes shares some limited aspects of this data with third parties for advertising purposes. We may also share online data collected through cookies with our advertising partners. This means that when you visit another website, you may be shown advertising based on your browsing patterns on our website.

How to manage cookies

You can set your browser not to accept cookies, and the above website tells you how to remove cookies from your browser. However, in a few cases, some of our website features may not function as a result.

Privacy policies of other websites

The GHAT website contains links to other websites. Our privacy policy applies only to our website, so if you click on a link to another website, you should read their privacy policy.

Changes to our privacy policy

GHAT keeps its privacy policy under regular review and places any updates on this web page. This privacy policy was last updated on 1st July 2020.

How to contact us

If you have any questions about GHAT’s privacy policy, the data we hold on you, or you would like to exercise one of your data protection rights, please do not hesitate to contact us.

Email us at: grampian.hospitalsarttrust@nhs.net

Or write to us at: Grampian Hospitals Art Trust, Art Office, Aberdeen Royal Infirmary, AB25 2ZN

How to contact the appropriate authority

Should you wish to report a complaint or if you feel that GHAT has not addressed your concern in a satisfactory manner, you may contact the Information Commissioner’s Office.

Email: Scotland@ico.org.uk

Telephone: 0303 123 1113

Address: The Information Commissioner’s Office – Scotland
45 Melville Street
Edinburgh
EH3 7HL

Updated July 2020