The Ballyshannon Museum respects your right to privacy and complies with our obligations under relevant data protection legislation including the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and the Data Protection Act, 2018.
The purpose of this Privacy Policy (“Policy”) is to outline how we process personal data, including special categories of data and the basis on which personal data is obtained from you or collected about you from third parties.
We take great care with any personal data we hold, so that we can provide the highest standard of service to you, whilst taking steps to keep your data secure and to ensure it is only used for the specified, explicit and legitimate purposes stated within this Policy.
Unless otherwise stated, the controller (as defined in the GDPR) of your personal data for all purposes outlined in this Policy is the NMI. We can be contacted by post at The Old Barracks, Main St, Townparks, Ballyshannon, Co. Donegal by phone +353 87 688 87 89 or by email at ballyshannonmuseum@gmail.com.
Please note that we reserve the right to update this Privacy Notice at any time as required.
Our data protection officer (“DPO”) can provide you with additional information on this Policy and your rights. Their contact details are below:
Address: Data Protection Officer, Ballychannon and District Museum, The Old Barracks, Main St, Townparks, Ballyshannon, Co. Donegal.
EIRCODE: F91 HTW5 .
Email: ballyshannonmuseum@gmail.com
‘We’, ‘our’, ‘us’, ‘BM’ refers to the Ballyshannon Museum. Our Museums include the Decorative Arts and History Museum.
The Ballyshannon Museum, 2013 established the museum as a non-commercial body.
We collect ‘personal data’, which is information that identifies a living person, or which can be identified as relating to a living person.
When we talk about ‘you’ or ‘your’ in this policy we mean any living person whose personal data we collect.
We collect personal data to enable the provision of services to support the purposes of Ballyshannon Museum. This includes when you access our ballyshannonmuseum.com website, when you submit information through our website (contact us forms), when you book a walking tour or visit to the museum.
The table below outlines the categories and types of data we collect. The types of data we collect may change over time; the following table is an indicative list to help you understand the types of data we collect.
| Process | Purpose | Lawful Basis | Type of Data |
| Booking Tickets for Groups | To allow you to book a walking tour or visit to yhe museum through the web site or at the museum. | Processing is necessary in order to take steps at the request of the data subject prior to entering into a contract with the Ballyshannon Museum. | Name, email, address, telephone number, city/town, country.
|
| CCTV | CCTV is present within the Ballyshannon Museum and its external environs. It is used to protect the National Collections, the investigation, detection or prosecution of criminal offences, and the protection of staff and visitors. | Processing is necessary for compliance with a legal obligation to which the controller is subject. Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. |
Image |
| Donations | To receive collection donations | Processing is necessary in order to take steps at the request of the data subject prior to entering into a contract with the Ballyshannon Museum. | Name, email, address, telephone number, audio (oral history) |
| To receive monetary donations from our sponsors | Name, email, address, telephone number, financial information | ||
| Collections | To register and maintain collections information. | Processing is necessary as a performance of a task. | Name, contact details, image. |
| Exhibitions | To display panels and information to visitors at our exhibitions. | Processing is necessary as a performance of a task | Name, image, possible special categories dependent on exhibition. |
| Event hire, photography and filming | Facilitating the use of Ballyshannon Museum sites for events, Photography and film production | Processing is necessary in order to take steps at the request of the data subject prior to entering into a contract with the Ballyshannon Museum. | Name, address, email address, phone number, bank details |
| Rights and Reproductions | Purchasing the rights to use Ballyshannon Museum images and photographs | Processing is necessary in order to take steps at the request of the data subject prior to entering into a contract with the Ballyshannon Museum. | Name, address, email address, financial information. |
| Online Store | To facilitate the purchasing of goods through our online store in the future. | Processing is necessary in order to take steps at the request of the data subject prior to entering into a contract with the Ballyshannon Museum.
|
Name, email, address, telephone number, financial information, payment details |
| Education | To facilitate online educational events | Performance of a task | Name, email, address, telephone number |
| Photography | Taking photographs at any of our events for marketing purposes. | Consent | Name, Image, address, email, phone number |
| Pre-Recruitment, Recruitment & Selection | To register a prospective candidate’s interest in recruitment for employment. To complete the recruitment process and assess candidate suitability. |
Processing is necessary in order to take steps at the request of the data subject prior to entering into a contract with the Ballyshannon Museum. Processing relates to our obligations in employment and for assessing your work capacity. |
Contact details, date of birth, application form or CV, work and educational history and interview notes |
| Proof of identity, proof of qualifications, undertake Garda Vetting, reference check, fitness to work medical assessment | |||
| Garda Vetting | |||
| Making or Receiving Payments | To make or receive any payments in the discharge of normal business functions, or to carry out any other payment requirements. | Processing is necessary for compliance with various employment and revenue laws. Processing is necessary for the performance of a contract to which the data subject is party. |
Tax reference number, bank name, bank address, BIC, IBAN, invoice payments. |
| Regulatory Compliance | To comply with financial regulations and any other relevant laws and regulations. | Processing is necessary for compliance with a legal obligation to which the controller is subject. Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract. |
Annual Financial Statements |
| Annual Reports and Publications | |||
| Minutes of Board Meetings / Strategic Plans | |||
| Archiving or destruction of Records | |||
| FOI and Data Protection Requests | |||
| Third Party Data Sharing | To allow us to conduct and carry out functions with third party service providers that enable us to deliver our services. | Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract. | Dependent on third party. |
| Back-ups | To store personal data and make back-ups of that data in case of emergencies and for disaster recovery purposes. | Processing is necessary for compliance with a legal obligation to which the controller is subject. | All soft copy versions of Ballyshannon Museum data is backed-up regularly. |
| Marketing | To send out our marketing materials such as our newsletter or any information on our exhibits and events. | Consent
|
Name, Email Address and postal address when necessary |
| Utilising photographs taken at events for marketing materials | Name, image | ||
| Managing our social media accounts | Legitimate interests – to provide customer service and answer queries | Name, Email address | |
| Admin | To perform administrative tasks which are a standard operation at Ballyshannon Museum. | Processing is necessary for the performance of a task. Processing is necessary for compliance with a legal obligation to which the controller is subject. |
Diaries (office) |
| Agendas of Meetings | |||
| Minutes of Meetings | |||
| Complaints | |||
| Communications | To enable communications between staff members internally and externally with third parties. | Legitimate interest | Emails |
| Email Archives | |||
| Sharefiles | |||
| Technical and Usage Data | Utilising cookies and AdWords to generate statistics | Consent | Technical information, including the Internet Protocol (IP) address used to connect your computer to the internet, the type of browser and operating system, the date and time of when you access our site, the pages you visit; and the website from which you accessed our site including any search terms used. Cookies and Adwords |
| Accident Reports | To compile a report should an accident or incident occur | To comply with a legal obligation | Name, imagery, medical data. |
We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact our data protection officer at the contact details listed in this Policy. If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so. Please note that we may process your personal data without your knowledge or consent, in compliance with this Policy, where this is required or permitted by law.
You can choose not to give us personal information; however, this may have an effect on you. We may need to collect personal information by law, or to enter into or fulfil a contract we have with you. If you choose not to give us this personal information, it may delay or prevent us from fulfilling our contract with you or doing what we must do by law.
We may share your personal data with outside organisations.
While the parties we engage may change occasionally, we believe it is important you are aware of the types of parties we share data with. The categories and types of third parties outlined below is a non-exhaustive list but provides an indication of the parties we share data with.
Third parties for the purposes of internal and external audits, carrying out research, and or third parties who may improve our processes and services (such as handling of payments or recruitment assistance)
.
Ballyshannon Museum is legally obligated to share personal data with state actors which is outlined in the Data Protection Act 2018. Recipients of this data include Government departments, agencies, bodies including public service bodies such as courts, investigatory bodies, local authorities and the Gardaí.
On exception, where personal data is transferred outside the European Economic Area, Ballyshannon Museum use safeguards, such as standard contractual clauses (SCCs), US-EU Data Privacy Framework, or an Adequacy Decision.
We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for. This means that the period of time for which we store your personal data may depend on the type of data we hold. To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.
Please be advised, the National Museum of Ireland is a place of deposit under the National Archives Act, 1986 and complies with the guidelines issued by the National Archives of Ireland on GDPR and the National Archives Act.
As a data subject, you will have the following rights are outlined in this section. However, restrictions may apply in certain situations.
Please send all requests to us at:
Email: ballyshannonmuseum@gmail.com ; or
Address:The Old Barracks, Main St, Townparks, Ballyshannon, Co. Donegal
EIRCODE: F91 HTW5
Upon receipt of a rights request, we will respond to the request without undue delay and at the latest within one month of receiving the request with an extension of two further months if required. If we require more time to deal with your request, we will notify you of the delay and the reasons behind it within 30 days of the receipt of the request. If we refuse your request, we will also notify you within 30 days of the receipt of the request accompanied by the reasons for the refusal.
You have the right to have Ballyshannon Museum correct any inaccurate personal data we have collected about you. You also have the right to have incomplete personal data completed; you may provide us with supplementary information to do this.
In certain instances, you have the right to have Ballyshannon Museum erase the personal data we have collected about you. Your right of erasure will apply in the following circumstances:
This right will not apply where we are required to process personal data in certain circumstances including the following:
Please note that the where the legal basis for our processing of personal data is on the basis of a legal obligation or public authority, some processing in relation to your data may not be subject to the right to erasure.
To determine your request for erasure, we will carry out an assessment of the justification for the retaining your personal data where a legal requirement applies and contact you if we are unable to fulfil your request.
Please be aware that in some circumstances we may need to retain some information to ensure all of your preferences are properly respected. For example, we cannot erase all information about you where you have also asked us not to send you marketing material. Otherwise, we would delete your preference not to receive marketing material.
You have the right to object to the processing of your personal data. However, the processing must have been undertaken on the basis of public interest or legitimate interest by us.
If you wish to object to the processing of data, please contact us with your request. We will then stop the processing of personal data unless it is required for legal proceedings.
You have the right to restrict the extent of personal data processed by the us in circumstances where:
When processing is restricted, your personal data will only be processed: with your consent; for the establishment, exercise or defence of legal claims; for the protection of the rights of other people; or for reasons important to public interest.
We will contact you confirm where the request for restriction is fulfilled and will only lift the restriction after we have informed you that we are doing so.
You have the right to know what personal data we hold on you, why we hold the data, and how we are processing your personal data.
When submitting your request, please provide us with information to help verify your identity and as much detail as possible to help us understand the information you wish to access.
There is usually no charge applied to access your personal data (or to exercise any of the other rights). However, if your request is clearly unfounded, repetitive or excessive, we may charge a reasonable fee. Alternatively, we may refuse to comply with your request in these circumstances.
You have the right to receive personal data concerning you which you have provided to us in a structured, commonly used and machine-readable format. You also have the right to provide this data to another controller or have Ballyshannon Museum transmit this data to another controller on your behalf, where technically feasible. This right to portability is limited to the following situations.
Where we are processing your personal data on the legal basis of consent, you are entitled to withdraw your consent at any time.
If you are not satisfied with our use of your personal data or our response to any request by you to exercise any of your rights, then you have the right to complain to the Data Protection Commission (DPC). Please see below for contact details of the DPC.
The Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28
Ireland. Phone: 01 7650100 / 1800437 737 Email: info@dataprotection.ie
For marketing purposes, we may contact you in relation to events, upcoming exhibitions, competitions and to issue our newsletter, via email.
Consent will always be provided in the form of a clear opt-in. You have the right to withdraw your consent at any time using the contact details listed in this section.
If you would prefer not to receive this type of communication from us, you can do any one of the following;
All emails will contain a link to unsubscribe or opt-out of future marketing communications from Ballyshannon Museum.
There may be instances where it is necessary for us to transfer your data outside of the European Economic Area (“EEA”) where privacy laws may not be as protective as those in your jurisdiction. There are special requirements set out under Chapter V of the GDPR to regulate such data transfers and ensure that adequate security measures are in place to safeguard and maintain the integrity of your personal data on transfer.
Where we transfer your personal data outside the EEA, we will make sure that it is protected to the same extent as in the EEA and we will use at least one of the following safeguards:
The Ballyshannon Museum is committed to protecting the privacy needs of children and we encourage parents and guardians to take an active role in their children’s online activities and interests. The National Museum of Ireland does not knowingly collect information from children under the age of 16 through its websites.
We won’t use the personal data of children or young people for marketing purposes and we won’t profile it.
Personal data about children and young people is only accessible by our staff on a strictly need-to-know basis.
For further details on our use of cookies, please refer to our Cookie Policy which you can view by visiting our web-page.
Ballyshannon Museum will take all steps reasonably necessary to ensure that your personal data is treated securely and in accordance with this Policy. We will use all reasonable efforts to put in place security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors, other recipients and other third parties who have a business need to know. They will only process your personal data on our instructions, and they are subject to a duty of confidentiality.
Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to our website; any transmission is at your own risk. Once we have received your information, we will use reasonable procedures and security features to try to prevent unauthorised access. We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.
Any changes to this Privacy Policy will be posted on this website so you are always aware of what information we collect, how we use it, and under what circumstances, if any, we disclose it.
Contact us. If you have any questions or complaints relating to this Policy, please contact us at:
Address: The Old Barracks, Main St, Townparks, Ballyshannon, Co. Donegal
EIRCODE: F91 HTW5
Email: ballyshannonmuseum@gmail.com
Effective date of this policy: 15 August 2024
