‍ Privacy Policy – Crewe Heritage Trust Limited‍

Effective Date: 17 July 2026
Last Updated: 17 July 2026

1. Introduction

Crewe Heritage Trust Limited (“we”, “us”, “our”) is committed to protecting and respecting your privacy. This policy explains how we collect, use, and protect personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This policy applies to:

• Visitors to our website

• Individuals who make purchases through our website

• Members of the Trust

• Volunteers

2. Who We Are

Crewe Heritage Trust Limited is a registered organisation operating a museum.

Our contact details can be found at the bottom of the page.

If you have any questions about this policy or your data, please contact us using the details above.

3. What Personal Data We Collect

a) Website Visitors

We may collect:

• IP address

• Browser type and version

• Device information

• Pages visited and usage data (via cookies)

b) Purchasers (Online Shop)

We may collect:

• Name

• Billing and delivery address

• Email address

• Payment details (processed securely via third-party providers)

• Order history

c) Members

We may collect:

• Name

• Contact details (email, address, phone)

• Membership status and history

• Payment records

• Communication preferences

d) Volunteers

We may collect:

• Name and contact details

• Emergency contact details

• Relevant experience or skills

• Availability

• DBS or background check information (if required)

• Ethnicity and gender preferences

4. How We Use Your Personal Data

We process personal data for the following purposes:

• To operate and improve our website

• To process purchases and deliver goods

• To manage memberships and renewals

• To organise volunteer activities

• To communicate important updates

• To comply with legal obligations

• To ensure the safety and security of our operations

5. Legal Bases for Processing

Under UK GDPR, we rely on the following lawful bases:

• Contract – to fulfil purchases and membership agreements

• Legitimate Interests – for running the museum and improving services

• Consent – for marketing communications (where applicable)

• Legal Obligation – to comply with applicable laws

• Vital Interests – processing necessary to protect a data subjects life

6. Cookies

Our website uses cookies to improve user experience and analyse usage.

Cookies may include:

• Essential cookies (required for website functionality)

• Analytical cookies (e.g. website traffic analysis)

You can manage or disable cookies through your browser settings.

7.CCTV Monitoring

Our museum operates Closed-Circuit Television (CCTV) systems throughout the premises for the purposes of security, crime prevention and detection, the protection of visitors, staff, volunteers and collections, and to assist in the investigation of incidents. CCTV images may capture individuals visiting or working at the museum. Recordings are accessed only by authorised personnel and may be shared with law enforcement agencies or other relevant authorities where required by law or where necessary for the prevention or detection of crime. CCTV footage is retained only for as long as necessary to fulfil these purposes and is then securely deleted in accordance with our data retention procedures.

8. Sharing Your Information

We do not sell your personal data. We may share your data with:

• Payment processors (e.g. for online purchases)

• IT and website service providers

• Delivery and postal services

• Legal or regulatory authorities where required

All third parties are required to respect the security of your data.

9. Data Retention

We retain personal data only as long as necessary, for instance:

• Purchase records: up to 6 years (for tax/legal purposes)

• Membership records: duration of membership + reasonable period

• Volunteer records: duration of volunteering + reasonable period

• Website analytics: typically anonymised and retained short-term

10. Your Rights

Under UK GDPR, you have the right to:

• Access your personal data

• Request correction of inaccurate data

• Request erasure (“right to be forgotten”)

• Restrict processing

• Object to processing

• Request data portability

• Withdraw consent at any time

To exercise these rights, please contact us. You can download a Subject Access Request template by clicking here.

Your request can be emailed or posted. Contact details can be found at the bottom of the page.

11. Data Security

We implement appropriate technical and organisational measures to protect your personal data from unauthorised access, loss, or misuse.

12. International Transfers

We do not routinely transfer personal data outside the UK. If we do, we will ensure appropriate safeguards are in place.

13. Children’s Data

Our website and services are not specifically directed at children. We do not knowingly collect personal data from children without appropriate consent.

14. Changes to This Policy

We may update this Privacy Policy from time to time. Updates will be posted on our website with a revised “Last Updated” date.

15. Complaints

You can access our Complaints Policy by clicking here. This page contains a link to a Complaint Form template.

This can be edited and either posted or emailed. Contact details can be found at the bottom of the page.

We are required to respond to your complaint within 1 month.

If you are unhappy with how we handle your data or any complaint, you can contact:

Information Commissioner’s Office (ICO)
Website: https://www.ico.org.uk
Telephone: 0303 123 1113