The notice provides information on:
- who we are
- how we use your information
- cookies and tracking
- Wi-Fi service
- conditions under which we use your information
- visitor and customer analytics and prospect research
- who we share information with
- transfers of data abroad
- how long we keep your information
- your rights
- access to personal information and correction
- consent and your right to opt out
- complaints, enquiries and feedback
- how to contact us
- changes to this privacy notice
- useful links
- This privacy notice does not cover links to external websites. We encourage you to read the privacy statements on the other websites you visit.
The Natural History Museum exists to inspire a love of the natural world and unlock answers to the big issues facing humanity and the planet. More than five million people visit the sites in South Kensington and Tring every year, and the website receives over 500,000 unique visitors a month. It is a world-leading science research centre, and through its unique collections and unrivalled expertise it is tackling issues such as food security, eradicating diseases and managing resource scarcity.
The Natural History Museum Trading Company (NHMTC) carries out the commercial activities of the Museum (e.g. events, retail and the Wildlife Photographer of the Year exhibition). As a wholly owned subsidiary, NHMTC is subject to the Museum's policies and procedures.
In this privacy notice and in the data protection statements which you will see wherever we collect your personal information, 'the Natural History Museum', 'the Museum' and 'we' refer to the Natural History Museum and the Natural History Museum Trading Company. As a wholly owned subsidiary, personal data may be shared from the Natural History Museum to the Natural History Museum Trading Company and vice versa.
The Museum is the data controller of your personal information.
When you give us your personal data we will explain specifically how we will use it in a fair processing statement with a link to this privacy notice. The main purposes for which we collect and process the details of customers, visitors, Members, service users, enquirers, donors and potential donors are to provide the service, goods or information that you have requested:
-
for administration purposes (e.g. to administer donations, and to keep a record of our relationship with you)
-
to further our charitable aims, including fundraising activities
-
to gather feedback
-
to enable the best possible supporter journey and experience
-
We may use your data to contact you by email (if you have given us your consent or are a business contact), post or phone with news and information about the Museum that we feel may be of interest to you as well as about our other special events, activities, products and services. We will not use your personal information in this way if you have opted out, unsubscribed or otherwise indicated that you do not wish to be contacted for such marketing purposes.
When you visit www.nhm.ac.uk, nhmshop.co.uk, data.nhm.ac.uk or any of the Museum's websites, we collect standard internet log information and details of visitor behaviour patterns. We do this to find out, for example, the number of visitors to the various parts of the site, to compile statistical reports on website activity and to personalise our visitors' website experience. We also use cookies and similar technologies to help us understand how you use our sites, and so that we can personalise your experience on the website and via other channels (for example if you are opted in to receive marketing emails). We also use similar technologies when sending marketing emails to understand which emails are being read and how customers interact with them.
Cookies are small blocks of data created by a web server to collect information while you are browsing a website. You can set your browser to not accept cookies and you can remove cookies from your browser. However, in a few cases some of our website features may not function as a result. You can read more about how we use cookies and how to disable them on our cookies page.
If you opt in to ‘Advertising’ cookies via our cookie preference centre, we use advertising cookies from third parties to allow us to assess the effectiveness of our adverts, and to optimise our digital advertising. These cookies can affect what you see on third party sites. Advertising cookies remember that you have visited a website and use that information to provide you with advertising which is tailored to your interests. This is often called online behavioural advertising (OBA) and is done by grouping together shared interests based upon web browsing history.
A guide to behavioural advertising and online privacy has been
produced by the internet advertising industry.
For details on the third-party cookies we use, and how to disable them, see our
Cookie Policy.
We follow the principles of fair and legal processing described in the General Data Protection Regulation. We will only process personal data under one of the available lawful conditions - for example, if:
a) You have
consented to the use of your personal data for the specific purpose in question. Examples of when we use this legal basis include:
-
to use your personal email account to send you marketing information – this includes information about our news, fundraising, events, products, and services
- to continue to contact you if you are a Museum donor, or potential donor, so that we can build and maintain our relationship and correspondence with you, once first contact has been made under legitimate interests
-
to conduct research and collect feedback from you regarding your visits to the Museum and to our website
-
to contact you by email if you have taken part in one of our citizen science projects and we require some more information about what you have found or seen
-
to provide you with access to our recruitment portal if you are a prospective applicant for a job vacancy or volunteer role
-
to contact you by post or phone if you are a Development Group contact who is signed up to the Telephone Preference Service or Mail Preference Service and you are not an existing donor
b) we need to process your personal data in order to deliver a contracted service, for example if you:
-
buy a ticket for an event
-
become a Member - the services we provide to Members are outlined in the membership terms and conditions and include: contacting you to renew your membership; sending out regular letters via email; analysing member activity to improve our services to you; providing customer service to answer questions or respond to feedback; contacting you about becoming a patron or making a donation to the Museum; and showing you relevant adverts on your social media based on your other activity and interactions as a Member
-
become a Patron - the way we use personal data of our Patrons is outlined in the Patrons application form and include: administrating your Patron membership; sending you a regular email newsletter and event invites; and sending you the Evolve magazine
-
register for an account to enter the Wildlife Photographer of the Year competition
-
take part in a competition the Museum is running
-
make an enquiry regarding booking a Museum venue for an event
-
decide to book a Museum venue for an event
-
enter into a brand licensing agreement with us
-
make a donation directly to the Museum, or through a third-party giving platform such as Just Giving with whom we have a contract
-
have a contract with us regarding requesting a research loan from the Museum’s collections
-
are donating an item to the Museum’s collections
-
complete the application process for a job or volunteer role at the Museum
-
are named as a signatory on a commercial contract that we have entered into, or we are seeking to enter into
c) we are entitled or required by law to process personal data in a certain way, for example:
- for fraud or crime prevention purposes
-
if you submit a data subject rights request we will process your information in order to assess and, where appropriate, action your request as according to the GDPR and Data Protection Act 2018
-
if you make a donation, we have a legal obligation to continue to store certain information about you and the donation for financial records keeping purposes as required under the Companies Act 2006
-
if you choose to add Gift Aid to a donation that you make, then we have a legal obligation to retain your gift aid declaration in order to comply with HMRC legislation
-
if you apply for a job at the Museum and provide us with any information about reasonable adjustments you require under the Equality Act 2010
d) we need to protect the vital interests of any person
-
to ensure that we meet the needs of attendees to certain events at the Museum, for example ensuring that dietary allergies are accounted for
e) we are required to process personal data in performance of a task carried out in the public interest or in the exercise of our official authority. Under Section 3 of the British Museum Act 1963, the Museum’s public task can be defined as a responsibility for keeping its collections and making them available for inspection by the public. Therefore, we will process your data under this legal basis if:
-
you are a collector, borrower or lender and have entered your details into our collection management system or data portal in association with one or more specimens or objects.
-
you are requesting or providing a loan, we will use the personal information you provide to contact you about the loan and help manage that loan
-
you are donating an object or specimen to the Museum, personal data will be used on the Material Transfer Agreement for the donation
-
your personal information forms part of an object or specimen's history
-
you wish to access Library, Archive and Public Records items in the Reading Rooms
-
you are captured in CCTV footage in and around the Museum premises in order to ensure safety and security of the collections and the public
f) the processing of personal data is within our legitimate interests, where we carry out activities that would not be considered to fall into the definition at (e) above, but are enabling the Museum to meet its objectives.
Types of personal data processing which are based upon the Museum’s legitimate interests include:
-
sending you marketing, publicity and fundraising mailshots that do not require your consent (such as postal or phone contact, or business to business communications)
-
if you are a Development Group contact who may be able to make a donation to the Museum, we may carry out prospect research on you before we first contact you to make sure we are aware of your interests and your giving capacity
-
if you are making a significant donation to the Museum, we may carry out due diligence research to ensure that the source of the donation aligns with our Mission and Values
-
carrying out visitor and customer analytics so we can better understand people’s interactions with the Museum and make improvements to make them better
-
If you choose to opt into email marketing, then a pseudonymised version of your email address may be shared with Facebook based on the legitimate interest lawful basis in order that Facebook can serve relevant adverts to you as well as to similar ‘lookalike’ audiences
-
exercising or defending against occasional legal claims that the Museum encounters, for example in the area of health and safety
-
corresponding with you if you have contacted the Museum with an enquiry or some feedback, this may involve passing on your email address to the relevant colleague who is able to best assist you
-
processing booking requests for education visits
-
so that we can send you relevant emails based on your interests and behaviour. We will do this by analysing information such as which pages you view on our website, commercial transactions (e.g. ticket and retail purchases) and activities (e.g. email actions, point of sign up to marketing) and postcode data in order to personalise the communications and content you receive, and better target our marketing. Please note that whilst this profiling activity is considered to be in our legitimate interests, information about your activity on our websites will only be collected and used for this purpose if you first consent to the setting of non-essential cookie categories via our cookie preference centre.
-
conducting feedback surveys in relation to specific events or exhibitions
-
processing visitor requests for disabled parking spaces at the Museum
-
processing information about individuals involved in security or health and safety incidents during a visit to the Museum, or whilst at an event on our premises
-
collecting names of participants involved in our citizen science activities, in order to ensure we have the necessary information to form a biological record
The legitimate interest legal basis also covers the processing of personal data during some of the Museum’s business to business activities, for example:
-
to review names and CVs of lead specialist individuals working at an organisation, in order to assess the expertise on offer from a supplier during the procurement process
-
to contact press and media contacts
-
to contact government contacts
-
to facilitate management of our teacher advisory network
-
to contact personal assistants of donors (or prospective donors) regarding matters such as whether the donor (or prospective donor) would like to attend a Museum event
-
to contact prospective donors in their business capacity - for example to consider corporate partnership opportunities, or emailing contacts at philanthropic trusts or foundations
-
to manage security requirements for business contacts visiting the Museum to meet with staff members
-
to encourage collaboration between our science staff with other researchers, scientists and curators beyond the Museum for purposes including research, collections use, laboratory use, and publications.
Special category personal data and criminal convictions information
Special category data is defined at Article 9 GDPR as personal data revealing:
-
racial or ethnic origin
-
political opinions
-
religious or philosophical beliefs
-
trade union membership
-
genetic data
-
biometric data for the purpose of uniquely identifying a natural person
-
data concerning health, or
-
data concerning a natural person’s sex life or sexual orientation.
Processing special category data will sometimes be necessary to ensure that the Museum can effectively provide a service to you, or so you can best enjoy what the Museum has to offer. For example, we may need information regarding accessibility requirements or dietary requirements so that you are able to access and enjoy our facilities and events. We may also need to process special category information, such as medical information, when recording and managing health and safety incidents.
Criminal conviction data
Article 10 GDPR covers processing in relation to criminal convictions and offences or related security measures. In addition, section 11(2) of the DPA 2018 specifically confirms that this includes personal data relating to the alleged commission of offences or proceedings for an offence committed or alleged to have been committed, including sentencing. This is collectively referred to as ‘criminal offence data’
When the Museum carries out due diligence research in order to accept support and donations, we may access special category information or information relating to criminal offences or convictions.
Profiling
‘Profiling’ is the word that data protection regulations use to describe activities which involve the behavioural characteristics of individuals being analysed to find out about their preferences, predict their behaviour, make decisions about them or classify them into different groups or sectors.
At the Museum, we carry out profiling activities because knowing more about our customers and supporters means that we can make sure we are communicating with you in the best possible way, with the most relevant information for your interests, and therefore giving you the best possible experience.
The specific profiling activities we may carry out include:
-
Predicting what products our shop customers might be interested in based on their online browsing history.
-
Combining online and offline data to build up a picture of an individual’s interests.
-
Segmenting our customers and supporters into different groups based on their likely interests, which are indicated by the nature of their interactions with the Museum.
Different ‘lawful bases' are used for different parts of the profiling process. This is detailed as follows:
If you opt into ‘performance’ cookies via our cookie preference centre, then consent is used to collect information about your activity on our websites.
-
If you opt into ‘advertising’ cookies via our cookie preference centre, then consent is used to collect information about your activity on our websites and to provide you with tailored Museum advertising when browsing other websites.
-
Information about website behaviours (collected via cookie consent) is combined with other information we know about you, for example ticket purchases, membership status and which part of the country you live in. This is used to decide which ‘segment’ best suits you, so that you can be provided with an experience of the Museum which is tailored to your likely interests and behaviours. This is based on the legitimate interest lawful basis as we consider that it is not only in the interests of our customers and supporters to have the best possible experience, but also allows us to increase engagement with the Museum’s mission to create advocates for the planet.
-
If you are opted in to receive email marketing from the Museum, then the consent lawful basis is used to send you relevant email content based on the segment you have been assigned to.
-
If you are a member, then the performance of a contract lawful basis is used to send you relevant email content based on the segment you have been assigned to, based on member communications being a membership benefit set out in the member T&Cs.
-
From time to time, the Museum may carry out postal or telephone marketing campaigns which use information gained from profiling and segmentation to ensure that you are contacted with the most relevant content. This is based on the legitimate interest lawful basis as we consider that it is not only in the interests of our customers and supporters to have the best possible experience, but also allows us to increase engagement with the Museum’s mission to create advocates for the planet.
We do not consider the profiling activities we carry out to be intrusive for the following reasons:
-
Our profiling and segmentation activities serve only to improve the relevance and quality of the interactions that our customers and supporters would otherwise be having with us anyway, rather than contacting you via additional channels which could be considered intrusive.
-
We ensure that you maintain control by ensuring that cookies tracking website behaviour and providing tailored web content are only set with user consent, and that marketing emails are only sent where consent has been provided.
-
The profiling that we carry out does not lead to automated decisions which could have legal or similarly significant effects on you.
-
We will never use special category data as part of our profiling activity.
It is within the Museum's legitimate interests to hold and analyse your data to continue to improve our understanding of our target audiences and supporters. This is so we can provide world-class, transformative, visitor-focused experiences, customer service and educational engagement, and effective and appropriate supporter engagement.
We carry out customer analytics to improve our understanding of our target audiences. We do this by analysing your commercial transactions (e.g. ticket and retail purchases) and activities (e.g. email interaction with the Museum, such as which emails you open and how often, use of Museum Wi-Fi including via cookies and similar technologies). This helps us target our marketing more efficiently, understand what topics you are interested in, and personalise and improve your experience if you have consented to receive marketing from us, by providing the most relevant and timely content.
You can object to our carrying out this kind of activity for marketing purposes by emailing
dataprotection@nhm.ac.uk, and we will review our basis for doing so in your case. Please note that objecting to this activity will mean that you are automatically unsubscribed from marketing.
Supporter research
As a recognised charity we seek to maximise our income from fundraising in order to achieve our aims and objectives. This support is vital in helping us continue our pioneering scientific research, education and conservation. In order to make our fundraising activities as effective as possible we therefore undertake supporter research in order to appropriately engage with high value donors.
Supporter research involves building up a holistic summary of an individual, their interests, suitability and likelihood they will donate and is fundamental to the ability to generate income through fundraising. Therefore, we may collect personal information to research potential supporters that have been identified through publicly available sources, personal referrals, recommendations from existing supporters, through their existing involvement with the Museum and occasionally from fully contracted independent researchers who work with us when we do not have the in-house capacity required.
In addition to information that our supporters provide to us, we may use data collected from publicly available quantitative and qualitative information to assess an individual’s inclination to provide financial and non-financial support and their areas of philanthropic interest, to enable the formulation of an approach which the individual finds attractive.
This may include:
-
Financial information (including whether particular donations or funding appeals may be of interest)
-
philanthropy and other giving (including donations to other organisations)
-
other support (for example, details of volunteering roles)
-
career highlights and other life achievements
-
a photograph of you
-
and information about areas of interest and extra-curricular activities.
We use targeted internet searches and may search the following websites where relevant in order to obtain and maintain the accuracy of the data listed above:
-
Archives from media outlets and archived press releases
-
company websites
-
Higher education institution websites
-
business-related resources including Companies House, One Source, BoardEx and Fame
-
Charity Commission and other internet sources for non-profits
-
LinkedIn, to check business details
-
public records databases
-
published rich lists.
We will not collect special category data without explicit consent from individuals, except in some specific instances, for example to record dietary or mobility requirements for attendance of an event.
We review this information using manual processes to gain a holistic understanding of potential supporters’ ability and willingness to make donations and also to determine which particular donations or funding appeals may be of interest to them.
This research helps us understand the background of the people who support us, and enables us to contact you in the most appropriate way, with the most relevant information. You can object to our carrying out this kind of activity for fundraising purposes by emailing
development@nhm.ac.uk, and we will review our basis for doing so in your case.
Our teams foster long term relationships with our existing and potential donors. However, we are committed to only keeping data on individuals with whom we have an active relationship. We therefore remove all non essential data captured if the existing or potential donor has not interacted with us in the previous three years, or if we no longer plan to engage with the individual as a supporter in the future. In specific situations approved on a case-by-case basis, we may occasionally decide to re-engage with these contacts should supporter research or the individual themselves offer strong evidence that they would be receptive to hearing from us and we determine after careful consideration that the processing is lawful and within the individual’s reasonable expectations.
We rely on legitimate interests as our lawful basis for processing data on our potential supporters. We have entered an ambitious period of change for the Museum, as we embark on our new strategy to 2031. Over the next decade, we will secure the future of our collection, deepen engagement with multiple audiences, and revolutionise the study of natural history. Supporter research enables us to deliver successful fundraising initiatives and unleash the Museum’s potential to help create a future where people and the planet thrive.
Due diligence research
Properly screened and fully contracted independent professional researchers may carry out due diligence on individuals before we seek or accept major donations to ensure compliance with legislation, financial rules, international agreements and guidance from statutory bodies and to protect us from reputational risk, as required. These legal and regulatory obligations mean that if you object to analysis of your data for the supporter research purposes detailed above, we may still conduct some due diligence research that is required in order for us to accept donations from you.
We will never sell your data. We will not share personal data with third-party organisations for their marketing purposes without your permission. However, we may disclose your personal information in the following circumstances:
-
to other Natural History Museum entities and trading subsidiaries
-
to suppliers, contractors or service providers who work for the Museum to help us provide products or services, for example: payment processing companies; ticketing providers; security services; mailing houses; event providers; companies that run competitions on our behalf; and analytical services that enable us to target our communications with customers and supporters more effectively
-
to third-party advertisers such as Facebook who help us to target our advertising communications. For example, if we are running a social media advertising campaign, we may provide some pseudonymised data to the third-party site for matching purposes, which enable us to identify and serve adverts to both yourself and to similar audiences likely to be interested in our content
-
in the case of Supporter Research information, where appropriate we may occasionally share information with development partners closely related to us, to process data for specific purposes on our behalf, on a considered, confidential basis managed through agreed processes
-
to corporate or strategic partners of the Museum, for example if we are running a joint event and you have signed a consent form to give your permission for images taken of you to be shared with the partner organisation so they can promote their relationship with the Museum
-
to professional advisers including lawyers, bankers and auditors
-
Occasionally we arrange events with other related organisations such as The International Friends of the Natural History Museum, a tax-exempt organisation under section 501 © (3) of the U.S. Internal Revenue Code. We may share your personal data with such organisations, for example where you register to attend events. We will only share information when necessary.
-
The Museum works with The Natural History Museum Foundation (NHMF). This is a registered charity that works with the Museum's Development team to raise funds and make grants to support the work of the Museum. The NHMF acts as a Data Processor for the Museum, which sometimes involves the sharing of personal data between the Trustees of the NHMF and the Museum.
In cases where the third party in question is supporting the Natural History Museum’s operations and services under our instructions as Data Controller, they would be defined by data protection law as Data Processors. These Data Processors are trusted partners who work with us to assist us in achieving our aims and objectives; they will not be permitted to use the data that we share with them for their own purposes. We require them to act lawfully in accordance with our instructions, and we ensure that appropriate controls (such as contractual Data Processing and Confidentiality Agreements) are in place to keep your information secure.
In addition, if we are required to do so in order to comply with a legal obligation (for example money laundering legislation or a court order) we may share your personal information with the police, law enforcement or regulatory bodies or relevant government authorities.
We will always ensure an adequate level of protection is provided for personal information transferred outside the European Economic Area. If the organisation we share personal data with is in a country without adequate data protection in place, we will place contractual requirements on the third-party organisation to handle personal data to the same standard that is required by legislation in the United Kingdom.
We will only use your personal data for the purposes for which it was obtained, unless we consider that we need to use it for another reason which is compatible with the original purpose.
The information that we hold about you will only be kept for as long as it is required to perform the required purpose.
Under the General Data Protection Regulation (GDPR) you have the following rights:
-
to obtain access to, and copies of, the personal data that we hold about you
-
to require us to correct any inaccurate personal data we hold about you
-
to require us to restrict our processing of your personal data
-
to object to us processing your personal data
-
to object to receiving marketing communications from us
-
to withdraw your consent to processing of your personal data
-
to require us to erase your personal data ('right to be forgotten')
-
to obtain from us the personal data which you have provided, in order to transmit it to another organisation ('data portability')
Please note that the above rights are not absolute, and we may be entitled to refuse requests where exceptions apply. How we deal with some of your rights are set out elsewhere in this privacy notice. You also have the right to refer your concerns or queries to the supervisory authority, the
Information Commissioner’s Office.
We strive at all times to ensure that your personal information is accurate and up to date. You may ask us to correct or remove information you think is inaccurate by contacting us as detailed in the 'How to contact us' section of this notice. If your personal details change, please help us to keep your information up to date by notifying us at the address below.
Under the terms of data protection legislation you have the right to request access to and a copy of information that we hold about you, by making a Subject Access Request. You can do this by:
-
emailing the Data Protection Officer at dataprotection@nhm.ac.uk
-
writing a letter to: Data Protection Officer, The Natural History Museum, Cromwell Road, London, SW7 5BD
