This policy explains how we use the data you share with us, or that we collect about you. It details why and how we collect your data, why we keep it, what we use it for, and what you can do if you’re unhappy about how we use it.

Brooklands Museum processes data in accordance with the UK General Data Protection Regulation, the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR). Data Protection law says that the personal information we hold about you must be:

·         Used lawfully, fairly and in a transparent way.

·         Collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes.

·         Relevant to the purposes we have told you about and limited only to those purposes.

·         Accurate and kept up to date.

·         Kept only as long as necessary for the purposes we have told you about.

·         Kept securely

·         In addition to this, the ‘Accountability Principle’ requires that we take responsibility for how we comply with the principles and demonstrate that compliance.

​​​​​​Who are “We”?

When we use “We”, “Us” or “Our” in this policy we are talking about Brooklands Museum Trust Limited, Brooklands Limited and Brooklands Trust Members.

The full legal information for these organisations is as follows:

Brooklands Museum Trust Ltd is a data controller and we are registered with the UK Information Commissioner’s Office (ICO), registration number Z2230213

Brooklands Museum Trust Ltd is a charity registered in England and Wales (296661) and a company registered in England and Wales at Brooklands Road, Weybridge KT13 0QN (2109945)

Brooklands Limited is a company registered in England and Wales at Brooklands Museum, The Clubhouse, Brooklands Road, Weybridge, Surrey KT13 0QN (02321226)

Type of data we collect

Personal data is information that can be used to identify an individual. This might include your name, address, telephone number or email address. We might store a variety of other information depending on the relationship we have with you.

Examples of the types of data we might handle include:

• Visitor data,
• Members data,
• Children’s data,
• Fundraising and Donation information,
• Events attendees,
• Hospitality and Venue Hire,
• CCTV images,
• Supporters/Partners information,
• Collections information,

Staff or Volunteers information: If you are a member of staff or volunteer with us we will store details we need to ensure your safety and that of our visitors, including special category data such as medical history or information required for DBS checks if appropriate. Personal information regarding staff and volunteers may include information that is classified as sensitive, such as racial or ethnic origin, medical records and criminal records. For more information on how we process data relating to staff and volunteers please see our separate Staff privacy policy.

How we collect data

Information is primarily collected during interactions with you, this may include:

• You may share your data with us when you’re buying a ticket, making a donation, attending or participating in an event, or working for us in a paid or voluntary capacity,
• You may share data with us when you sign up for our newsletters or enter competitions, either in person at the Museum or via our website or social media channels, or when you register to use Wi-Fi on our site,

You will know we have this information because you will have given it to us.

• We may also have your information if it has been shared with your consent by a third party, such as a car club or aviation organisation.
• We may supplement information we hold with other relevant, publicly available information, such as social media accounts, published articles or information available through places like Companies House.

Why we collect data

We use your personal data in a variety of ways, depending on the relationship we have with you. The most common of these ways include:

• Communicating with you,
• Fulfilling requests from you or agreements we have with you, such as applications for and delivery of Membership and its benefits,
• Processing sales transactions, donations or other payments,
• Identifying visitors, suppliers and participants to the Museum and its events,
• Recording any contact, we have with you,
• Providing you with information that we think may be of interest to you, including information about the Museum, its events and the projects it is undertaking, including fundraising and marketing,
• If you are a volunteer, participant or supplier, we will use your information to help us manage the Museum and its events to provide the best possible experience for our visitors and customers.

Lawful Basis for Processing Data

We, and those that process personal data on our behalf, must have a lawful basis or ground for processing before we can process personal data.

We have an Appropriate Policy Document which sets out how we comply with the additional requirements on special category and criminal offence data. View the policy >

Our legal basis for processing personal data is as follows:

What we collect	Why we collect it	Legal Bases
Individual Subscriber: If you are an e-newsletter subscriber	To keep you up to date with news about our work, events, products, special offers and ways of supporting the Museum	Consent
If you contact us with an enquiry	To enable us to respond to your enquiry about a booking, purchase or reservation	Contract
	To enable us to respond to your enquiry (dependent on nature of the enquiry)	Consent Legitimate Interests Public Task
Visitor data: information about you, purchases you make from our shop or other transactional arrangements or donations you make to us.	If you sign up to Gift Aid, we are required to obtain your name and postal address	Legal obligation
	To send you your tickets	Contract
	If you buy a ticket for an exhibition or event	Contract
	To contact you if there is a change to an activity you have booked	Contract
	To keep you up to date with news about our work, events, products, special offers and ways of supporting the Museum	Consent
	Processing of special category data to allow us to take actions to support those with medical or other needs e.g. dietary.	Explicit Consent
Membership data: Data we require to process any agreement we have with you regarding any memberships you hold with us.	To contact you regarding your Membership and provide you with your benefits.	Contract
	To allow us to set up your direct debit or process your payment.	Contract
	If you sign up to Gift Aid, we are required to obtain your name and postal address	Legal obligation
Children’s data: information relating to educational visits, school, college or university information, information about teachers/supervisors.	Contact details, bank details, of visit organiser	Contract if the booking is direct with an individual   Legitimate Interests where the booking is with a school/group
	Information about visit attendees including adults and/or children	Legitimate Interests
	Processing of special category data to allow us to take actions to support those with medical or other needs e.g. dietary.	Explicit Consent
Fundraising and Donation information: such as contact data, amount of donation, payment information.	To allow us to process your payment.	Contract
	If you sign up to Gift Aid, we are required to obtain your name and postal address	Legal obligation
Events: Specific events you have attend or activities or visits you undertake as an organiser, exhibitor or group.	Information about event attendees including adults and/or children	Legitimate Interests
	Processing of special category data to allow us to take actions to support those with medical or other needs e.g. dietary.	Explicit Consent
Hospitality and Venue Hire: We may collect data about the booking, people attending etc.	To complete your booking	Contract if the booking is direct with an individual   Legitimate Interests where the booking is with a company/group
	Processing of special category data to allow us to take actions to support those with medical or other needs e.g. dietary.	Explicit Consent
CCTV images: We have CCTV cameras on site which may capture visitors, volunteers and staff.	CCTV is in operation in public areas at the Museum	Our and your legitimate interests – we use CCTV for security purposes which records movements of individuals around our site.
Interested Parties	We may hold details relating to organisations you represent or are involved with or vehicles you own or have a demonstrable interest in if you have given it to us or made it available on public forums that we reasonably might be expected to use for research for our work.	Public Task   Legitimate Interests
Collections	To record the details of disposals from and gifts, purchases, and loans to our collections including audio, paper or electronic copies of archive material, oral histories, associated with those objects or with the history of Brooklands.	Public Task   Legal Requirement

When we contact you

Depending on the communication preferences you’ve indicated, we will contact you about things that we think will interest you, based on the data we hold and our reasonable assumptions. This correspondence might include

• Information about upcoming events based on your consents and your historical attendance,
• Information about the Museum and its displays and exhibitions, including occasional requests to consider giving financial support to the Museum.

Opting out

Our correspondence will always include contact details or links to enable you to change your contact preferences, so even if you’ve opted-in to receiving information from us, you can opt-out at any time.

In addition to using the unsubscribe link in any messages you receive, you can also check and change your contact preferences at any time by emailing [email protected].

There are some Membership and donation communications that we are required to send regardless of your contact preferences. These are essential communications, deemed necessary to fulfil our contractual obligations to you. Examples would include Direct Debit confirmations and advanced notices, thank you letters, Membership benefits such as the Brooklands Bulletin or equivalent magazine and the monthly e-newsletter and Membership cards, renewal reminders, Gift Aid confirmation letters and querying returned mail or bounced Direct Debit payments with you.

Unsolicited Corporate Marketing

We may contact corporate contacts with unsolicited marketing.  Our legal basis for this is legitimate interests and we comply with the Privacy and Electronic Marketing Regulations (PECR) by only contacting corporate subscribers and always offering an opt out.

Data sharing

We will never sell or share your information to other organisations to use for their own purposes.

As part of our service to you, we do need to share your information with third-party organisations who we engage to carry out work on our behalf. They might include:

• Our on-site catering, hospitality and event partners
• Mailing houses that post copies of the Brooklands Bulletin or other printed material, or specialist email distributors,
• IT specialists who help us manage and maintain our database,
• Other professional marketing or fundraising specialists who we engage to help us with these aspects of our work,
• Financial specialists contracted by us to deliver specific services, such as direct debit or gift aid processing.

We ensure that any third-party we use complies with the UK GDPR and the Data Protection Act 2018. Sharing with a third-party (known as a Data Processor) will always be carried out under contract, as part of which we will specify that your data must be kept safely, used only under our instructions, and not be used for the third parties’ own purposes without prior agreement.

Joint promotions

Occasionally, we promote and manage events in partnership with other organisation, and personal data specific to that event is collected by both us and the partner organisation. When this is the case, it will be clearly advised at the time the information is collected.

Retention of Data

We will only keep your information for as long as we need it to manage the relationship we have with you, based on the parameters of that relationship, or for as long as we are legally required to.

We have retention schedules that set out how long we keep information. When we dispose of your data it will be done securely.

As a museum we have an archive and as such there may be instances where data is kept indefinitely in line with the provisions of the GDPR that do not apply to data processed for research or for archiving in the public interest.

Information Security

The security of your data is of the greatest importance to us, and we have put in place appropriate technical and organisational security measures to prevent your personal data from accidental or unlawful unauthorised use, access, and disclosure as well as being altered or destroyed in an accidental or unlawful manner. Personal data within Brooklands Museum is only shared with those who need to access it to carry out their role.

We store information on paper files in our registered office, on computers located in the UK, and on reputable cloud services and third-party organisations that may be situated inside or outside the European Economic Area.

Data Subject Rights

Under the UK GDPR and the Data Protection Act 2018, you have the following rights:

·         Right to be informed: This notice provides you with information in relation to how your data is processed. This ensures that we are transparent about what we will do with the information you supply to us.

·         Right of Access: You also have the right to access a copy of the information we hold about you. This is sometimes known as a Subject Access Request.

·         Right to rectification: You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.

·         Right to erasure: You have the right to ask us to erase your personal information in certain circumstances.

·         Right to object: You have the right to object to processing if we are able to process your information because it is in our legitimate interests. You can also unsubscribe from our mailings and remove your details at any time.

·         Rights in relation to automated decision making and profiling: We do not use data for automated decision making or profiling.

·         Right to data portability: This only applies to information you have given us. You have the right to ask that we transfer the information you gave us from one organisation to another or give it to you.

You can ask us to fulfil any of these rights by contacting us, to ensure this is dealt with as efficiently as possible please direct any data rights request to [email protected] or by writing to Data Protection, Brooklands Museum, Brooklands Road, Weybridge, Surrey KT13 0QN.

Contact Us

Brooklands Museum is committed to processing personal data fairly and lawfully. If you have queries or concerns, please contact us at [email protected] and we’ll respond.

If you remain dissatisfied, you can make a complaint about the way we process your personal information to the Information Commissioners Office (ICO). Please follow this link to the ICO website for more information https://ico.org.uk/make-a-complaint/. Or contact them at ico.org.uk or

Information Commissioner’s Office 

Wycliffe House                 

Water Lane

Wilmslow

Cheshire

SK9 5AF

Changes to this privacy policy

Whenever we update our privacy policy we will update this page on our website.

Version 1: This Privacy Policy was first introduced on the 22 May 2018.

Version 2: This Privacy Policy was last updated on 13^th November 2024.

Cookies and Tracking

This website uses cookies to improve the user's experience while visiting the website. Where applicable this website uses a cookie control system allowing the user on their first visit to the website to allow or disallow the use of cookies on their computer / device. This complies with recent legislation requirements for websites to obtain explicit consent from users before leaving behind or reading files such as cookies on a user's computer / device.

Cookies are small files saved to the user's computers hard drive that track, save and store information about the user's interactions and usage of the website. This allows the website, through its server to provide the users with a tailored experience within this website.

Users are advised that if they wish to deny the use and saving of cookies from this website on to their computers hard drive they should take necessary steps within their web browsers security settings to block all cookies from this website and its external serving vendors.

This website uses tracking software to monitor its visitors to better understand how they use it. This software is provided by Google Analytics which uses cookies to track visitor usage. The software will save a cookie to your computers hard drive in order to track and monitor your engagement and usage of the website, but will not store, save or collect personal information. You can read Google's privacy policy for further information

Other cookies may be stored to your computers hard drive by external vendors when this website uses referral programmes, sponsored links or adverts. Such cookies are used for conversion and referral tracking and typically expire after 30 days, though some may take longer. No personal information is stored, saved or collected.