Jaguar Daimler Heritage Trust (JDHT) is committed to protecting the privacy of Trustees, employees, volunteers inc. waiting list, customers, archive users, vehicle drivers and members of the public, and holds secure any personal data that is shared with us or collected by us. The personal data, in any format, that we collect and hold, is important to us and is handled in accordance with this Policy. We are committed to ensuring that your privacy is protected.
This Policy has been reviewed against the introduction and focus on strengthened data privacy rules across the EU, under the General Data Protection Regulation.
Who we are
JDHT’s aim is to establish, maintain and promote for the benefit of the nation, the permanent preservation of historic archives, artefacts and motor vehicles manufactured and sold by Jaguar Cars Ltd (now renamed Jaguar Land Rover Ltd) and its predecessor companies under the marquee names of Swallow, SS, Jaguar, Daimler and Lanchester, where such vehicles are of actual potential historic, scientific importance and education value.
We are registered with the Information Commissioner’s Office (ICO) as a data controller and processor; registration number ZA076353. Any service providers that we use are required by contract to protect the confidentiality of the personal information we share with them and to use it only to provide specific services on our behalf.
Privacy Officer (Data Protection Officer)
Jaguar Daimler Heritage Trust
British Motor Museum
Or email: firstname.lastname@example.org
We are registered as a Charity under the Charities Act, 1960, and our registration number is: 286863
We are registered under the Companies Act, 2006, and our registration is: 1709907.
Our registered office address is: Abbey Road, Whitley, Coventry, CV3 4LF.
Why we collect data
We collect, store and process personal data of Trustees, employees, volunteers inc. waiting list, customers, archive users, vehicle drivers and members of the public for the purposes of fulfilling contractual and legal obligations, because it is in our legitimate interests to do so or because we have your explicit consent to do so. We will only collect data when it is necessary to do so to meet our responsibilities to you and to improve and deliver our services to you.
Your personal information will only be used for the purpose or purposes it was collected.
Personal data we collect and how we use it
Trustees – We collect personal data (name, date of birth, contact details etc.), biometric data and records of attendance at meetings and opinions for contact purposes, to fulfil our Charitable obligations with the Charities Commission and Companies House, for authentication purposes and to keep a record of JDHT matters.
Employees – We collect personal data (name, date of birth, contact details etc.), education and work history data, financial data (bank details, pension details etc.) health data and additional data (driving licence details, emergency contacts, sickness and holiday records, appraisal, training and disciplinary records, records of accidents etc.) for contact purposes, processing payroll and our pension obligations, expense purposes, event purposes, driving and insurance purposes, health and safety purposes and to fulfil our obligations to you.
Volunteers – We collect personal data (name, date of birth, contact details, etc.), financial data (bank details), health data and additional data (driving licence details, emergency contacts, training records, records of accidents etc.) for contact purposes, expense purposes, event purposes, driving and insurance purposes, health and safety purposes and to fulfil our obligations to you.
Customers – We collect personal data (name, contact details, etc.), financial data (payment details, billing address etc.) and, dependent on the product, additional data (vehicle details etc.) for contact purposes and for purposes of providing our products and services and licensing the use of archive material.
Archive Users – We collect personal data (name, contact details, etc.) and a description of materials accessed for contact purposes and for maintaining a record of archive material accessed and the terms agreed to by the researcher.
Vehicle Drivers – We collect personal data (name, contact details, etc.) and additional data (driving licence details, emergency contacts etc.) for contact purposes and driving and insurance purposes when driving vehicles on behalf of JDHT. We also use vehicle GPS to locate our vehicles in the event of theft or a breakdown.
Material held in the Archive – We collect material associated with Jaguar Cars Ltd (now renamed Jaguar Land Rover Ltd) and its predecessor companies under the marquee names of Swallow, SS, Jaguar, Daimler and Lanchester. This can include, but is not limited to, personal data (name, contact details, etc.), apprentice and employee records, correspondence, photographs and film footage for the purposes of archiving in the public interest.
Other members of the Public and General Enquirers – We collect personal data (name, contact details, etc.) and a description of items donated, loaned or purchased to and from JDHT for the purposes of meaningfully recording and indexing our collections and the terms agreed to by both parties. We collect personal data (name, contact details, etc.) for the purposes of responding to general enquiries.
Legal base for processing personal data
• Contract – your personal information is processed in order to fulfil a contractual arrangement
• Consent – where you agree to us using your information for a specific purpose
• Legitimate Interests – For our own (or a third party’s) legitimate interests in managing our charity and it’s collections provided your rights do not override these interests, such as:
-Sending suitable communications to you
-Monitoring and improving our products and services
• Legal Obligation – where there is statutory or other legal requirement to share the information e.g. when we have to share your information for law enforcement purpose.
How long do we keep your data for?
We keep data for as long as it is necessary to meet our business needs and obligations. JDHT follows recognised data retention standards. The periods of time vary dependent on legal obligations, financial regulations and internal requirements. We will always securely destroy data when it is no longer required.
Who handles your data within JDHT?
Groups of people who may handle or process personal information for JDHT in the course of their duties are:
All Trustees, employees and volunteers who handle or process personal information act in line with this policy, our Data Protection Policy and the data protection principles. Training is provided to ensure all Trustees, employees and volunteers understand their obligations.
Who do we share data with?
We share personal data with third parties who process data on our behalf for the purposes of providing services to you. This includes email and IT providers, payment providers, digital archive and storage providers, specialist consultancy providers, auditors and our online invoicing system.
We share data with a related party of JDHT – Jaguar Land Rover Limited. They provide IT, data storage, communication, shredding and driving related services to us.
We share personal data about employees with HMRC, pension providers and payroll services in line with our legal obligations. We also share employee personal data with our online HR system and Jaguar Land Rover Limited.
We share personal data about Trustees with Jaguar Land Rover Limited, the online Companies Register and government departments such as Companies House and the Charities Commission.
All third party processors we use are legally obliged to safeguard your information in the same way we would. We will not sell or disclose your personal information to any other third parties unless we have your permission, where we are required to do so by law or where we use a third party to securely process our data on our behalf.
How do we secure your data?
We are committed to ensuring that your information is collected and stored safely and securely. In order to prevent unauthorised access or disclosure, we have put in place suitable physical, electronic and managerial procedures. We continually monitor our security and embed it within our day-to-day actions. Our website is maintained on a secure server. All our employees, volunteers and service providers meet the standards and security measures we require. Staff and volunteer training is undertaken regularly, and checks are made by IT staff to ensure data quality is maintained.
Unfortunately, no data transmission or storage system is completely secure. If you feel that the security of your account or interaction with JDHT has been compromised, please contact us immediately. If such a disclosure does occur, we will contact you as soon as possible to explain what has happened and take all steps required of us to meet our obligations under the legislation. JDHT have a Data Breach Policy in place to ensure we meet our obligations.
Where your information is stored
Your information is held securely in the UK. If your information is transferred outside the UK for any purposes, then we will take measures to ensure that your data remains protected at all times to the standard imposed by the General Data Protection Regulation.
What are your rights?
You can ask us to make changes in how your data is handled and we will respond promptly should a request be made. You have the following rights over the personal data about you that we are holding and processing:
• Right to be informed – This Policy provides you with information in relation to how your data is processed. This ensures that we are transparent about what we will do with the information you supply to us.
• Right of access – You may request details of personal information which we hold about you under the Data Protection Act 2018 and the General Data Protection Regulation. This is called a Subject Access Request. For guidance on how to submit a Subject Access Request, please click here.
• Right to request information held is accurate and how to update it. If you believe that any information we are holding on you is incorrect or incomplete, please contact us and we will respond as quickly as possible.
• Right to erasure (also known as the Right to be Forgotten) – In certain circumstances, you may ask us to delete information about you and stop processing or publishing it.
• Right to object to the processing that is likely to cause you damage or distress. Where you challenge the accuracy or lawful processing of your information, we will consider this.
• Right to data portability – You can ask us to provide the personal data about you we hold, securely and in a machine-readable format, so it can be moved, copied or transferred to be used across different services or for you to give to another organisation.
• Right to object – where you object to processing of your personal information.
• Rights with regards to automated individual decision making, including profiling – If there is additional profiling based on the information we hold, then you can object to us making decisions about you based on such processing.
If you have any general questions about your rights or how we manage your personal data please contact our Privacy Officer.
External Links to other Sites
A cookie is a small file which asks permission to be placed on your computer’s hard drive. The web application can tailor its operations to your needs, likes and dislikes by gathering and remembering information about your preferences such as identifying your computer’s previous visits to a website, ascertaining the most popular features of a website or enabling an organisation to present specific information to you.
We use third parties, including Google Analytics, to collect anonymous user information. Google Analytics stores information about what pages you visit, how long you are on the site, how you got here and what you click on. They do not collect or store your personal information (e.g. your name or address) so this information cannot be used to identify who you are. We do not allow Google to use or share our analytics data.
You can turn cookies off but please remember that if you do choose to disable cookies, you may find that certain sections of our website do not work properly as some cookies are essential for the website to work. You will, however, still be able to view site content.
If you wish to make a complaint about how we have processed your personal information, and we cannot resolve it, then you have the right to lodge a complaint to the Information Commissioner:
The Information Commissioner’s Office
Notification of Changes
This Policy was last updated in April 2019.