Who controls your data
The data controller is Derbyshire County Council.
Legal basis of processing
There are 3:
- consent
- contract
- public task
Information we collect and why
Consent
Information is obtained with your permission, and we'll make sure you know this when you sign up. You can withdraw consent at any time.
We collect simple contact details if you subscribe to an e-newsletter or mailing list covering:
- public events (in libraries, the arts, museum or record office)
- major projects (such as Derbyshire Lives in the First World War)
- creative events (information for artists and arts administrators, including new opportunities such as a photography competition or arts grant)
We often take photographs of our events. A photograph which includes you can count as your personal data, so we'll ask your permission before taking your picture. We'll record this on a consent form, if:
- we know the photo is going to reach a wide audience - for example, local news, council publications
- the photo reveals additional information about you - for example, captioned with your name
- you're a child, or giving consent on a child's behalf - the form asks your relationship to the child
With consent, we use personal information in public engagement projects, aimed at improving people's lives. These includes health and wellbeing projects run by the arts service, such as dementia-friendly film screenings. Your personal health information is one example of 'special category' data. If we gather 'special category' data when you participate in an outreach activity, we'll get your explicit permission for the ways in which we plan to process the data.
Contract
We keep lists of our contractors, commercial customers, suppliers and partner organisations, so that we can manage our business arrangements properly. This includes you if:
- we supply you with services, such as family history research, use of photographic and video equipment on our premises, permission to publish a photograph or loan of outreach materials
- we pay you for services, for example as part of a lottery-funded outreach project
Public task
We collect basic contact details such as name and address to help us administer:
- group visits, including schools
- ticketed events
- bookings by organisations to use our meeting rooms and exhibition spaces
- regular outreach sessions organised by us, such as book groups (including a listening group used mainly by people with impaired sight), coding clubs for children, or computer assistance sessions
A data processor for some of our events is Eventbrite, an online service. The company has its own privacy notice for its users.
We like to know what you think of our events and services so will sometimes ask for your feedback using evaluation forms or a comments book. Comments books are most commonly used for museum exhibitions and major developments such as the opening of a new library building.
These public tasks are covered by sections 7 and 20 of the Public Libraries and Museums Act 1964.
How long we keep your information
Generally, we keep personal information for 6 years. This period is commonly used in the retention schedules covering leisure and culture. However, there are exceptions, as we need to hold information for longer or shorter than that if it's necessary to achieve our functions. All the different time periods are laid out in our retention schedules.
Sharing your information
We do not ordinarily share your information unless you have provided consent to do so, it's necessary to achieve our functions or we have a legitimate interest in sharing the information with a third party.
We'll also share information as required by law. Information will not be shared with third parties for the purpose of marketing and will not be used for automated decision-making.
Keeping you information safe
We are committed to protecting personal data and have data policies and procedures in place to ensure that it is safeguarded.
Your rights and who to contact about them
You can find out more about your rights as a data subject but here are the main things you need to know:
- if you gave consent for us to have your information, we will delete it if you ask us to
- if you want a copy of your own information, please ask us
- if you want to complain about how we handle your personal data you can contact the data protection officer:
- you have the right to contact the Information Commissioner
Find out other ways of getting in touch with us.