Privacy Notice (Image Library Clients)

Privacy Notice

The Royal Armouries Group has recently implemented a new Customer Records Management (CRM) System to store the
personal information of our stakeholders, including visitors, shop customers, educational contacts, members,
supporters, donors and sponsors, and commercial clients, which was previously held in a number of separate
databases. As part of this process we have reviewed our existing mailing lists, which have been compiled over a
significant period of time, and identified some overlap in the interests of some the stakeholders in some of the
lists. We have therefore consolidated some of these stakeholders into new mailing lists based on their common
interests. The new CRM System allows us to better understand our customers and their interests, and to communicate
with them more efficiently and effectively. It also allows us to better ensure that our customers information and
their rights under data protection legislation are fully observed. The information held in the old databases has
been securely destroyed.

When we ask you to provide us with your personal information we will let you know why we need your data and how we
will use it, and will direct you towards this notice for further information.

  1. Who we are

    The Royal Armouries Group consists of the Royal Armouries (RA), the National Museum of Arms and Armour in the
    United Kingdom; Royal Armouries Trading and Enterprises Limited (RATE), a company registered in England and
    Wales, which carries out commercial activities on behalf of the Museum; and Royal Armouries (International)
    plc (RAI), which previously provided café facilities, catering and corporate events at the Museum and was
    acquired in 2018.

    In this privacy notice and in the data protection statements which you will see wherever we collection your
    personal information, ‘Royal Armouries’, ‘the Museum’, and ‘we’ refer to the Royal Armouries Group.

    The Museum is the data controller of your personal information.

  2. What information do we collect about you

    The personal information we collect from you will vary according to how you engage with the museum, but may

    • Name
    • Contact details for communications, e.g. postal address, email address and telephone number
    • Confirmation of your ID and current address
    • Ticket purchase and event registration/attendance
    • Special requirements, such as diet or access
    • Bank account, bank or credit card details, including Direct Debit bank details where applicable
    • Donation information
    • Gift Aid status
    • Information about your interests and activities
    • Employment information and professional activities
    • Copies of correspondence sent to/received from you
  3. How will we use the information about you

    We may use your personal information in a number of different ways to:

    • ensure that you enjoy your visit to the museum or our website;
    • provide you with the opportunity to book and attend our events;
    • enable you to take part in our competitions;
    • allow you to purchase items from our shop or online;
    • allow you to bring school, college or university groups to participate in classroom sessions or
      self-guided tours of the museum;
    • permit you to bring other groups to the museum for guided tours of the galleries, and a glimpse behind
      the scenes;
    • encourage you to donate or lend items to the collections;
    • enable you to request information about our collections, arms and armour, the Tower of London and
      related subjects;
    • allow you to visit our Library and Archives Reading Room and access our Study Collections for research;
    • enable you to purchase and license film and images from our Image library;
    • enable you to license the Royal Armouries brand;
    • encourage you to support the work of the museum through donations;
    • enable you to become a member or patron and enjoy private views of new exhibitions and other exclusive
    • enable you to hire our corporate and private function facilities at Fort Nelson;

    We may also use your personal information to:

    • keep you up-to-date with news about the museum, and information on exhibitions and events, retail
      offers, fund raising activities etc.;
    • process your payments by sharing your bank or credit card details with third parties such as Shopify Pay
      and Natwest Bank;
    • deliver your goods;
    • protect your consumer rights;
    • allow you to feedback on your experience;
    • permit us to deal with your complaints;
    • maintain records relating to your engagement with us as a customer;
    • analyse your interests and shopping habits and send you information about products we feel may be of
      interest to you;
    • enable you to contribute to our market research;

    For more detailed information on the how we use your personal information, why we use it, and how long we
    keep it for please refer to our Data Protection Register, a summary of which can be found at

  4. Marketing

    We may use your personal information for marketing purposes either with your consent or where we believe that
    we have a legitimate interest in sending you news about the Museum, and information relating to our
    collections, exhibitions, events and activities, retail offers, fund raising activities etc. and where this
    coincides with your interests based on your previous engagement with us.

    You may create an online account to provide us with more information about your interests, and to refine your
    marketing options.

    You may opt out of receiving marketing information at any time by:

    • logging onto your online account;
    • using the opt-out link at the bottom of any email we send you;
    • emailing us at;
    • writing to us at Communications Department, Royal Armouries, Armouries Drive, Leeds, LS10 1LT;

    Please note. Requests to opt-out of marketing information may take 48 hours to process.

  5. How we use CCTV

    CCTV is used extensively throughout the Museum to protect our visitors and staff, to deter and detect crime,
    and to assist in the investigation of incidents. We abide by the CCTV Code of Practice in the management of
    any information recorded, and the footage is usually kept for 30 days and then destroyed, unless there is a
    need to retain it as evidence as part of an on-going investigation and in case we are required to disclose
    it as evidence in any legal proceedings. Further information may be found in our CCTV Policy.

  6. How we ensure your information is up to date

    We carry out routine checks of the personal information we collect to ensure that it is accurate and
    up-to-date. We will also contact you from time to time to check that any information we hold about you is
    relevant for the purposes of processing.

  7. Who we share your information with 

    We will not share your details with any third parties, nor disclose your personal information to any third
    parties or external organisations, other than those data processors and service providers carrying out work
    on our behalf. The Museum carries out comprehensive checks on any companies working on our behalf before we
    work with them, and we put contracts in place in line with the data protection legislation that sets out our
    expectations and requirements, especially regarding how they manage your personal information. For specific
    information on who we share your personal information with please refer to our Data Retention Schedules, a
    summary of which can be found in the policies section at

    In the event where we wish to share your personal information in a way that is not covered in this statement,
    we will apply for your explicit and informed consent.

  8. How we keep your information secure

    The Museum has implemented security procedures to ensure that the personal information under our control is
    protected from unauthorised access, improper use, unauthorised modification, accidental or malicious
    disclosure. All employees and data processors are obliged to respect the confidentiality of the personal
    information of our visitors, friends and supporters.

  9. How long do we keep your information

    Your information will be retained within our secure information systems for as long as you continue to engage
    with us, and it will then be securely destroyed or transferred to the Museum’s archives as appropriate. For
    specific information on how long we keep your personal information please refer to our Data Retention
    Schedules, a summary of which can be found at

  10. How you can access your information

    Access to personal information collected by the Museum is provided under the terms of the General Data
    Protection Regulations. You may request a copy of the personal information that we hold about you at any
    time by emailing or writing to us at the contact details below. There is usually no charge for making this
    request, and we will normally respond to you within one month (twenty working days). We may ask you for
    proof of identity and request further details to assist us in the location of your personal information.

    If we hold a large amount of information about you or your request is complicated, then we may need to charge
    you a reasonable fee, based on the cost of providing the information, and extend the deadline by up to two
    months. We will advise you of any charges or delays in responding to your request.

    If we consider your request to be manifestly unfounded or excessive we may refuse to respond, and we will
    write to you explaining our decision. You have the right to appeal, and if you are still unhappy to complain
    to the Information Commissioner’s Office, or to seek a judicial remedy.

  11. What other rights you have

    The General Data Protection Regulations also grant you the rights:

    • to have your personal information rectified if it is inaccurate or incomplete;
    • to request the deletion or removal of your personal information (the right to be forgotten);
    • to ‘block’ or suppress the processing of your personal information;
    • to obtain and reuse your personal information for your own purposes across different services;
    • to object to processing based on legitimate interests or the performance of a task in the public
      interest/exercise of official authority (including profiling); direct marketing (including profiling);
      and processing for purposes of scientific/historical research and statistics; and
    • not to be subject to a decision when it is based on automated processing, and it produces a legal effect
      or a similarly significant effect on you.

    You may ask us to change or remove any personal information you have given us at any time by emailing or
    writing to us at the contact details below. There is no charge for making this request, and we will normally
    comply within one month (twenty working days). We will keep a record of your request for a period of two
    years in order to show that we have complied with the Regulations after which it will be destroyed.

    For further information on your rights visit the Information Commissioner’s website,

  12. How to contact us?

    If you have any questions about our privacy policy, or you would like to request a copy of the personal
    information we hold about you, or ask us to change or remove your personal information please contact our
    Data Protection Officer:

    Philip Abbott
    Data Protection Officer
    Royal Armouries
    Armouries Drive
    LS10 1LT

    If you feel that we have not upheld your rights and wish to make a complaint, you should contact our Data

    Malcolm Duncan
    Data Controller
    Royal Armouries
    Armouries Drive
    LS10 1LT

  13. How to contact the Information Commissioner?

    If you are not satisfied with our response to your request to remove, change or provide any personal
    information, or if you believe that we are not processing your personal information in accordance with the
    law, you have the right to complain to the Information Commissioner’s Office:

    Information Commissioner’s Office

    Wycliffe House
    Water Lane
    SK9 5AF

    Telephone 0303 123 113



Your download will start shortly, please do not navigate away from this page until the download prompt has appeared. Doing so may cause your download to be interrupted.