The Royal School of Needlework (Registered Charity No. 312774) and RSN Enterprises Limited (Company No. 03158058) (“RSN”/”we” or “us”) promise to respect any personal data you share with us and keep it safe. We aim to be clear when we collect your data and not do anything you wouldn’t reasonably expect.
The RSN now operates an ‘opt-in only’ communication policy. We will continue to make contact with people who have booked a course or tour or made Studio or shop purchases as part of the administration of their purchase. However, we will only send marketing information on any of our areas of work, to those people who have explicitly stated that they are happy for us to do so via their preferred channel(s) of communication (email, post, SMS or phone).
Marketing information from the RSN may include information about classes, student successes, the work of the Studio, fundraising appeals, shop products, events and exhibitions. If you would like to receive such communications but have not opted in please contact us on/click this link and complete the form.
This policy describes how and why the Royal School of Needlework uses your personal information, how we protect your privacy when doing so, and your rights and choices regarding this information. We promise to respect any of your personal information which is under our control and to keep it safe. We aim to be clear when we collect your personal information about what we will do with it.
The RSN is a long-standing charity. We have relationships with past and present students, Friends, donors, customers, supporters, volunteers, Trustees and staff so we use personal data on a day to day basis in order to operate. Our use of personal data is to help you our customers and supporters and to fulfil our mission of keeping the art of hand embroidery alive.
How we will use your personal data
Data protection laws require that the personal data we hold about you must be
- Obtained, processed and use fairly, lawfully and in a transparent way
- obtained only for a valid, specified and lawful purpose, that we have clearly explained to you, and shall not be used in any manner incompatible with those purpose(s);
- relevant to the purposes we have told you about and limited only to those purposes;
- accurate and kept up to date;
- Kept secure and confidential
- kept only for as long as required for the purposes we have told you about.
How we collect information about you
We may collect information in several ways, depending upon how you interact with the RSN.
Information you give us
You may give us your personal information in order to sign up to our e-newsletter, book or pay for a class, register as a potential student for an open day or as an applicant, make a donation, purchase from the RSN shop, send a query, request an estimate from the Studio, take part in a competition at an event or otherwise communicate with us.
In addition, in accordance with common website practice we will receive information about the type of device that you are using to access the RSN website or RSNdegree website. This is to ensure that what you are seeing on the site looks at its optimum. We do not use this information for any other purpose.
Information you provide to us indirectly
Your information may be shared with us by third parties, for example
- UCAS/UCA for degree applicants
- Joint event organisers
- If you nominate the RSN to be the recipient of donations through a third party.
- Where we are providing tuition through a third party (eg online distance learning)
Information from other sources
We also use information from the following sources
Depending on your settings or the privacy policies for social media and messaging services like Facebook, Twitter or Instagram, you might give us permission to access information from those services, for example when you publicly tag us in an event photo.
What personal information we collect
We collect, store and use the following kinds of personal information
- your title and name
- your contact details including postal addresss, email address, telephone number and social media identity
- your date of birth (where required)
- your employer if appropriate (eg for suppliers, school contacts, media contacts etc)
- if you volunteer for us (including as a Trustee) or apply for a job with us, information necessary for us to process your application and assess your suitability for the role (which may include things like employment history, previous experience as well as any unspent criminal convictions or pending court cases you may have)
- information required by the owners or managers of our locations (which in the case of Historic Royal Palaces (HRP) may include details of criminal convictions)
- Information about your activities on our websites (pages you look at) and the device(s) used to access these, for instance your IP address and geographical location
- Details about the kind of RSN activities you are interested in that you have provided to us
- Information you have provided to us about potential legacies or donations
- Information as to your taxpayer status to enable us to claim Gift Aid
- Records of classes attended and marks if the course is assessed
- Records of donations you have given whether financial or in kind
- Details of your bank account only if paying by Direct Debit
- And any other personal information you provide to us.
We do not store credit or debit card or other payment details.
How we use your information
We will use your personal information to:
- provide you with the courses, services, products or information you asked for;
- administer your donation including processing Gift Aid;
- manage Friends and Special Supporter records
- keep a record of your relationship with us including attendance on courses and assessment marks;
- respond to or fulfil any requests, complaints or queries you make to us;
- understand how we can improve our services, products or information by conducting analysis and market research;
- manage our events;
- further our charitable objectives;
- send you correspondence and communicate with you;
- process applications for bursaries and report to bursary funders;
- administer our websites and to troubleshoot, perform data analysis, research, generate statistics and surveys related to our technical systems;
- testing our technical systems to make sure they are working as expected;
- display content to you in a way appropriate to the device you are using (for example if you are viewing content on a mobile device or a computer);
- generate reports on our work, services and events;
- safeguard our staff, volunteers and others (including children where applicable);
- monitor website use to identify visitor location, guard against disruptive use, monitor website traffic and/or personalise information which is presented to you;
- process your application for a job or volunteering position;
- conduct training and quality control;
- audit and administer our accounts;
- meet our legal obligations, for instance to perform contracts between you and us, or our obligations to regulators, government and/or law enforcement bodies (eg HMRC for Gift Aid) and our landlords (eg HRP)
- carry out fraud prevention and money laundering checks;
- undertake credit risk reduction activities; and/or
- establish, defend or enforce legal claims.
We always seek to process the minimum personal data required.
How we use your information to tell you about our work
Our newsletters provide information on the RSN’s work and that of its students. They provide information on forthcoming events and activities, and the outcomes of fundraising campaigns and other initiatives. Occasionally we may include information from partner organisations or organisations who support us.
We operate an opt-in only communication policy for the e-news. The paper newsletter is only available as part of Friends’ membership.
Sending marketing communications
Our marketing communications include information about our courses, Studio offers, campaigns, our own and third party events, exhibitions, talks and tours, bespoke and private classes, news of successes, visitors and events, requests for donations or volunteers or other support. Occasionally we may include information from partner organisations or organisations who support us. We operate an opt-in only communication policy for marketing and participants are able to tell us which areas of our work they would like to hear about.
We will use your declared preferences and your past activities and geographic location to tailor our communications with you about future courses/events/appeals/opportunities.
Sending course/tour information
When you have booked a course or tour with the RSN we will send you details about the course included but not limited to access instructions, materials required if applicable, timing, location, tutor, brief. Where you are a group organiser we will ask for a list of participant names only. These names will only be added to the database if each individual person signs their own permission slip and provides their contact details.
Managing your contact preferences
We are endeavouring to make it as easy as possible to opt out of hearing from the RSN about something that no longer interests you.
You can opt out from the e-news at any time by clicking on the unsubscribe button. You can inform us of areas you do and do not wish to hear about at any time by emailing marketing@royal-needlework
If you decide that you don’t want to be contacted for marketing purposes, we may still need to contact you for administrative purposes. This may include administration of attending a class, processing a sale in the shop or Studio, processing a donation and collecting Gift Aid, keeping in touch regarding volunteering activity, participating in an event and thanking you for any of the above.
Legal basis for processing
Data protection laws mean that each use we make of personal information must have a “legal basis”. The relevant legal bases are set out in the General Data Protection Regulation (EU Regulation 2016/679) and in current UK data protection legislation.
Consent is where you have told us we may use your information in a certain way, for example when we send you marketing material via post, phone, text or e-mail). You have the right to withdraw consent for any future use of your information for this purpose at any time.
We have a basis to use your personal information where we need to do so to comply with one of our legal or regulatory obligations. For example, in some cases we may need to share your information with our various regulators such as the Charity Commission, Information Commissioner, Office for Students, Quality Assurance Agency for Higher Education, University for the Creative Arts or to use information we collect about you for due diligence.
Performance of a contract / take steps at your request to prepare for entry into a contract
We have a basis to use your personal information where we are entering into a contract with you or performing our obligations under that contract. Examples of this would be if you are taking a course or you are buying something from us (for instance some branded merchandise or, in some cases, an event place), applying to work/volunteer with us.
We have a basis to use your personal information where it is necessary for us to protect life or health. For instance if there were to be an emergency impacting individuals at one of our events, or a safeguarding issue which required us to contact people unexpectedly or share their information with emergency services.
We have a basis to use your personal information if it is reasonably necessary for us to do so and in our “legitimate interests” (provided that what the information is used for is fair and does not unduly impact your rights).
We consider our legitimate interests to include all of the day-to-day activities the RSN carries out with personal information. Some examples not mentioned under the other bases above where we are relying on legitimate interests are:
- analysis of our students and supporters using personal information we already hold;
- use of personal information when we are monitoring use of our website or apps for technical purposes;
- use of personal information to administer, review and keep an internal record of the people we work with, including supporters, volunteers, Trustees and staff;
- sharing of personal information between relevant teams and Council within the RSN and RSN Enterprises;
We only rely on legitimate interests as a basis for processing where we consider that any potential impact (positive and negative) is minimal. We also take into consideration how intrusive it is from a privacy perspective and where your rights under data protection laws do not override our (or others’) interests in us using your information in this way.
The RSN stores and uses only limited amounts of sensitive data, as defined by the GDPR Act of 2016. In relation to students this would include health information (where this impacts learning or access needs) and assessment grades.
How we keep your personal data safe
We have instigated a number of controls to protect your data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. We limit access to the database to those employees and volunteers who have a legitimate business need to use your data. Third parties, when used, will only have a process role.
As part of our data security measures we ensure that we train our employees and volunteers and have appropriate data protection policies in place to support our compliance.
How long we keep your information
The Royal School of Needlework is a longstanding organisation and many people have come in and out of a relationship with us over long periods of time. As such we will retain the records of people who have transactions with us and review every five years those on our mailing list who have no transaction record to ensure they still wish to hear from us. Some information, such as financial transactions must be kept for a number of years.
Sharing your information with third parties
The RSN will never sell or rent your information to third parties for marketing purposes. We may disclose your information to third parties in connection with
- Business processes such as a bulk mailing, class administration
- If you are a legacy giver to discuss information with co-beneficiaries
- Our auditors
- Our IT/database service providers
We will only share your personal data for the purposes specified in this privacy statement and on the basis that it will be confidential and will only be used for the reasons described.
Transferring information outside the European Economic Area (EEA)
On occasions the RSN may transfer information abroad and outside the EEA for the running of classes in Japan, North America and potentially other countries. These countries may not have the same data protection standards as the UK/EEA but in these cases we will take steps to ensure there is adequate protection in place to ensure compliance with UK law (eg EU Model Clauses).
Where we are under a legal or regulatory duty to do so, we may disclose your details to the police, regulatory bodies or legal advisors and/or where we consider this necessary to protect the rights, property or safety of the RSN, its personnel, visitors, students, or others.
Keeping your information up to date
As a small organisation the RSN must rely on data subjects to supply changes of name/address/email or telephone and if appropriate bank details for direct debits. We will ask for updates annually in order to endeavour to keep the details we have on you up to date.
You are, of course, free to opt out from receiving any information from the RSN at any time simply contact us by ringing 020 3166 6932 or email@example.com
We really appreciate it if you let us know any changes to your contact details.
Your rights in connection with personal data
Under UK data protection law, you have rights over personal information that we hold about you. We’ve summarised these below:
Request access to your personal data
You have a right to request access to the personal data that the RSN holds about you (data subject access request). You also have the right to request a copy of the information we hold about you, and we will provide you with this unless legal exceptions apply.
If you want to access your information, send a description of the information you want to see by post to The Chief Executive’s Office RSN Apt 12A Hampton Court Palace, East Molesey, KT9 9AU or by email to firstname.lastname@example.org. The information the RSN holds will be provided to you within one month.
Request correction of the personal information we hold about you
You have the right to have inaccurate or incomplete information we hold about you corrected. If you believe the information we hold about you is inaccurate or incomplete, please provide us with details and we will investigate and, where applicable, correct any inaccuracies.
Request the restriction of processing of your personal information
You have a right to ask us to restrict the processing of some or all of your personal information in the following situations: if some information we hold on you isn’t right; we’re not lawfully allowed to use it; you need us to retain your information in order for you to establish, exercise or defend a legal claim; or you believe your privacy rights outweigh our legitimate interests to use your information for a particular purpose and you have objected to us doing so.
Request the erasure of your personal information
You may ask us to delete some or all of your personal information and in certain cases, and subject to certain exceptions, you have the right for this to be done.
Request your personal information to be portable/transferable
If we are processing your personal information (1) based on your consent, or in order to enter into or carry out a contract with you, and (2) the processing is being done by automated means, you may ask us to provide it to you or another service provider in a machine-readable format.
Right to object to the use of your personal information
If we are processing your personal information based on our legitimate interests or statistics, you have a right to object to our use of your information.
If we are processing your personal information for direct marketing purposes, and you wish to object, we will stop processing your information for these purposes as soon as reasonably possible.
If you want to exercise any of the above rights, please contact us at the Chief Executive’s office, RSN Apt 12A Hampton Court Palace, East Molesey Surrey, KT8 9AU by email to email@example.com. We may be required to ask for further information and/or evidence of identity. We will endeavour to respond fully to all requests within one month of receipt of your request, however if we are unable to do so we will contact you with reasons for the delay.
Please note that exceptions apply to a number of these rights, and not all rights will be applicable in all circumstances. For more details we recommend you consult the guidance published by the UK’s Information Commissioner’s Office (ICO (link is external)).
If you wish to exercise any of your rights, or your have any questions about this Privacy Statement, how we handle your personal data or if you wish to make a complaint, please write to The Chief Executive’s office RSN, Apt 12A Hampton Court Palace, East Molesey, Surrey KT8 9AU or email firstname.lastname@example.org
Right to complain
You also have the right to make a complaint at any time to the ICO, the UK supervisory authority for data protection issues. The ICO’s contact details are Wycliffe House, Water Lane, Wilmslow Cheshire SK9 5AF Telephone 0303123 1113 or at https://ico.org.uk.
Changes to the privacy statement
We reserve the right to update this Privacy statement at any time, and we will notify you if we make any substantial changes. We may also notify you in other ways from time to time about the processing of your personal data. You should check our website at www.royal-needlework.org.uk periodically to view the most up to date Privacy Statement.