Privacy Policy
Purpose
Jaguar Daimler Heritage Trust (JDHT) is committed to protecting the privacy of Trustees, employees, volunteers inc. waiting list, customers, archive users, vehicle drivers and members of the public, and holds secure any personal data that is shared with us or collected by us.
The personal data, in any format, that we collect and hold, is important to us and is handled in accordance with this Policy. This Privacy Policy describes how we collect and use personal information about you during and after your working relationship with us, in accordance with the Data Protection Act 2018 and the UK General Data Protection Regulation (UK GDPR).
As a data controller under data protection law, JDHT is responsible for deciding how we hold and use personal information about you. We are required to notify you of the information contained in this Privacy Policy.
It is important that you read and retain this notice, together with any other Privacy Policy we may provide on specific occasions when we are collecting or processing personal information about you, so that you are aware of how and why we are using such information and what your rights are under the data protection legislation.
Data protection principles
We will comply with the relevant data protection law. Personal information must be:
• Used lawfully, fairly and in a transparent way.
• Collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes.
• Relevant to the purposes we have told you about and limited only to those purposes.
• Accurate and kept up to date.
• Kept only as long as necessary for the purposes we have told you about.
• Kept securely.
JDHT will maintain records of our compliance with these principles as part of our broader commitment to accountability.
Who we are
JDHT’s aim is to establish, maintain and promote for the benefit of the nation, the permanent preservation of historic archives, artefacts and motor vehicles manufactured and sold by Jaguar Cars Ltd (now renamed Jaguar Land Rover Ltd) and its predecessor companies under the marquee names of Swallow, SS, Jaguar, Daimler and Lanchester, where such vehicles are of actual potential historic, scientific importance and education value.
We are registered with the Information Commissioner’s Office (ICO) as a data controller and processor; registration number ZA076353. Any service providers that we use are required by contract to protect the confidentiality of the personal information we share with them and to use it only to provide specific services on our behalf.
If you have any questions about this Privacy Policy, how to manage the use of your personal data or to remove your data from our records, you can contact our Data Protection Officer at:
Privacy Officer (Data Protection Officer)
Jaguar Daimler Heritage Trust
Collections Centre
British Motor Museum
Banbury Road
Gaydon
Warwickshire
CV35 0BJ
Or email: privacyofficer@jaguarheritage.com
Our Data Protection Officer is Naomi Korn Associates Ltd.
We are registered as a Charity under the Charities Act, 1960, and our registration number is: 286863.
We are registered under the Companies Act, 2006, and our registration is: 1709907.
Our registered office address is: Abbey Road, Whitley, Coventry, CV3 4LF.
Why we collect data
We collect, store and process personal data of Trustees, employees, volunteers inc. waiting list, customers, archive users, vehicle drivers and members of the public:
For the purposes of fulfilling a contract with you, for example to provide you with physical or virtual access to collections as an archive user.
Legal obligation, where there is statutory or other legal requirement to share the information e.g. when we have to share your information for law enforcement purpose.
Our (or a third party’s) legitimate interests (and we will have completed a legitimate interest assessment), for example for individuals in the archive material; managing our charity and its collections provided your rights do not override these interests, such as fraud prevention.
Your consent, for example in relation to direct marketing
Your personal information will only be used for the purpose it was collected. Where relevant, specifically for individuals in the archive material, we may collect special category data when our lawful basis would be Archiving in the public interest with archival purposes as the additional basis in the Data Protection Act 2018, Schedule 1, paragraph 4(a).
Personal data we collect and how we use it
Trustees – We collect personal data (name, date of birth, contact details etc.), biometric data and records of attendance at meetings and opinions for contact purposes, to fulfil our Charitable obligations with the Charities Commission and Companies House, for authentication purposes and to keep a record of JDHT matters.
Employees – We collect personal data (name, date of birth, contact details etc.), education and work history data, financial data (bank details, pension details etc.) health data and additional data (driving licence details, emergency contacts, sickness and holiday records, appraisal, training and disciplinary records, records of accidents etc.) for contact purposes, processing payroll and our pension obligations, expense purposes, event purposes, driving and insurance purposes, health and safety purposes and to fulfil our obligations to you.
Volunteers – We collect personal data (name, date of birth, contact details, etc.), financial data (bank details), health data and additional data (driving licence details, emergency contacts, training records, records of accidents etc.) for contact purposes, expense purposes, event purposes, driving and insurance purposes, health and safety purposes and to fulfil our obligations to you.
Customers – We collect personal data (name, contact details, etc.), financial data (payment details, billing address etc.) and, dependent on the product, additional data (vehicle details etc.) for contact purposes and for purposes of providing our products and services and licensing the use of archive material.
Archive Users – We collect personal data (name, contact details, etc.) and a description of materials accessed for contact purposes and for maintaining a record of archive material accessed and the terms agreed to by the researcher.
Vehicle Drivers – We collect personal data (name, contact details, etc.) and additional data (driving licence details, emergency contacts etc.) for contact purposes and driving and insurance purposes when driving vehicles on behalf of JDHT. We also use vehicle GPS to locate our vehicles in the event of theft or a breakdown.
Material held in the Archive – We collect material associated with Jaguar Cars Ltd (now renamed Jaguar Land Rover Ltd) and its predecessor companies under the marquee names of Swallow, SS, Jaguar, Daimler and Lanchester. This can include, but is not limited to, personal data (name, contact details, etc.), apprentice and employee records, correspondence, photographs and film footage for the purposes of archiving in the public interest.
Other members of the Public and General Enquirers – We collect personal data (name, contact details, etc.) and a description of items donated, loaned or purchased to and from JDHT for the purposes of meaningfully recording and indexing our collections and the terms agreed to by both parties. We collect personal data (name, contact details, etc.) for the purposes of responding to general enquiries.
How long do we keep your data for?
We keep data for as long as it is necessary to meet our business needs and obligations. JDHT follows recognised data retention standards. The periods of time vary dependent on legal obligations, financial regulations and internal requirements. We will always
securely destroy data when it is no longer required.
Employees and volunteers is retained for the length of your employment or volunteering with JDHT + 6 years.
Unsuccessful applicant data is retained for 6 months following successful appointment of a post holder.
After the retention period has expired for previous employees and volunteers a core record may still be retained compromising on your name, date of birth, start and end dates and job title. JDHT’s lawful basis for this is our legitimate interests, please do contact us if you have any questions relating to this at enquiries@jaguarheritage.com.
Who has access to your data within JDHT?
Groups of people who may handle or process personal information for JDHT in the course of their duties are:
• Trustees
• Employees
• Volunteers
All Trustees, employees and volunteers who handle or process personal information act in line with this policy, our Data Protection Policy and the data protection principles. Training is provided to ensure all Trustees, employees and volunteers understand their obligations.
Who do we share data with
We share personal data with third parties who process data on our behalf for the purposes of providing services to you. This includes email and IT providers, payment providers, digital archive and storage providers, specialist consultancy providers, auditors and our online invoicing system.
We share data with a related party of JDHT – Jaguar Land Rover Limited. They provide IT, data storage, communication, shredding and driving related services to us.
We share personal data about employees with HMRC, pension providers and payroll services in line with our legal obligations. We also share employee personal data with our online HR system and Jaguar Land Rover Limited.
We share personal data about Trustees with Jaguar Land Rover Limited, the online Companies Register and government departments such as Companies House and the Charities Commission.
All third party processors we use are legally obliged to safeguard your information in the same way we would. We will not sell or disclose your personal information to any other third parties unless we have your permission, where we are required to do so by law or where we use a third party to securely process our data on our behalf.
In some instances, we may share your data with the emergency services in the event of an accident, our lawful basis to do so would be to protect your vital interests if you were not in a situation to be able to give consent. We may also need to share personal data to comply with the law or a request from a law enforcement agency such as the police.
How do we secure your data?
We are committed to ensuring that your information is collected and stored safely and securely. In order to prevent unauthorised access or disclosure, we have put in place suitable physical, electronic and managerial procedures. We continually monitor our security and embed it within our day-to-day actions. Our website is maintained on a secure server. All our employees, volunteers and service providers meet the standards and security measures we require. Staff and volunteer training is undertaken regularly, and checks are made by IT staff to ensure data quality is maintained.
When appointing any data processors or third parties JDHT carries out appropriate due diligence and ensure that appropriate contracts are in place that discuss data protection and our expectations. In the event that the JDHT is transferring personal data outside of the UK and EEA to a country that is not deemed adequate in terms of data protection we will ensure that appropriate safeguards are in use.
No data transmission or storage system is completely secure. If you feel that the security of your account or interaction with JDHT has been compromised, please contact us immediately. If such a disclosure does occur, we will contact you as soon as possible to explain what has happened and take all steps required of us to meet our obligations under the legislation. JDHT have a Data Breach Policy in place to ensure we meet our obligations.
Where is your information stored?
Your information is held securely in the UK. If your information is transferred outside the UK for any purposes, then we will take measures to ensure that your data remains protected at all times to the standard imposed by data protection laws and current industry practice.
What are your rights?
You can ask us to make changes in how your data is handled and we will respond promptly should a request be made. You have the following rights over the personal data about you that we are holding and processing:
• Right to be informed – This Policy provides you with information in relation to how your data is processed. This ensures that we are transparent about what we will do with the information you supply to us.
• Right of access – You may request details of personal information which we hold about you under the Data Protection Act 2018 and the General Data Protection Regulation. This is called a Subject Access Request. For guidance on how to submit a Subject Access Request, please click here.
• Right to request information held is accurate and how to update it – If you believe that any information we are holding on you is incorrect or incomplete, please contact us and we will respond as quickly as possible.
• Right to erasure (also known as the Right to be Forgotten) – In certain circumstances, you may ask us to delete information about you and stop processing or publishing it.
• Right to object to the processing that is likely to cause you damage or distress – Where you challenge the accuracy or lawful processing of your information, we will consider this.
• Right to data portability – You can ask us to provide the personal data about you we hold, securely and in a machine-readable format, so it can be moved, copied or transferred to be used across different services or for you to give to another organisation.
• Right to object – where you object to processing of your personal information.
• Rights with regards to automated individual decision making, including profiling – If there is additional profiling based on the information we hold, then you can object to us making decisions about you based on such processing.
If you have any general questions about your rights or how we manage your personal data please contact our Privacy Officer.
External links to other sites
The JDHT website contains links to other external internet sites. JDHT is not responsible for the privacy practices or the content of such Web sites. Once you have used these links to leave our site, you should note that we do not have any control over that other website. Therefore, we cannot be responsible for the protection and privacy of any information which you provide whilst visiting such sites and such sites are not
governed by this Privacy Policy. You should exercise caution and look at the privacy statement applicable to the website in question.
Use of cookies on our website
A cookie is a small file which asks permission to be placed on your computer’s hard drive. The web application can tailor its operations to your needs, likes and dislikes by gathering and remembering information about your preferences such as identifying your computer’s previous visits to a website, ascertaining the most popular features of a website or enabling an organisation to present specific information to you.
We use cookies necessary for the functioning of our website and shop such as to carry information across pages of the site, to avoid having to re-enter information or to maintain a shopping basket. We also use them for reporting and analytic purposes such as to track how many individual unique users we have and how often they visit our website. We collect data that lists which of our pages are most frequently visited and by which types of users and from which countries.
We use third parties, including Google Analytics, to collect anonymous user information. Google Analytics stores information about what pages you visit, how long you are on the site, how you got here and what you click on. They do not collect or store your personal information (e.g. your name or address) so this information cannot be used to identify who you are. We do not allow Google to use or share our analytics data.
You can turn cookies off but please remember that if you do choose to disable cookies, you may find that certain sections of our website do not work properly as some cookies are essential for the website to work. You will, however, still be able to view site content.
Complaints
If you wish to make a complaint about how we have processed your personal information, and we cannot resolve it, then you have the right to lodge a complaint to the Information Commissioner:
The Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Notification of Changes
JDHT conducts regular reviews of this Privacy Policy to ensure compliance with current regulations and care of your personal data. Please familiarise yourself with this policy each time you use our site or services to note any changes. You should check this page from time to time to ensure that you are aware of any changes.
This Policy was last updated in September 2024.