MOLA is committed to protecting your privacy. Our updated Privacy Notice sets out how we collect and use your personal data.
Who we are
MOLA (Museum of London Archaeology) is a company limited by guarantee registered in England and Wales, company registration number 07751831, charity registration number 1143574. Our registered office is at Mortimer Wheeler House, 46 Eagle Wharf Road, London N1 7ED. MOLA is registered as an organisation with the Chartered Institute for Archaeologists. MOLA is the data controller of your personal data and is registered with the Information Commissioner (ICO) under registration number ZA027153.
Questions and contact information
It is important that you read this Privacy Notice together with any other privacy notice or fair processing notice we may provide on specific occasions when we are collecting or processing personal data about you so that you are fully aware of how and why we are using your data. This Privacy Notice supplements the other notices and is not intended to override them.
If you have any questions about this Privacy Notice or how MOLA uses your personal data, please contact us by email at privacy@mola.org.uk or by writing to us at Data Protection Officer, MOLA, Mortimer Wheeler House, 46 Eagle Wharf Road, London N1 7ED.
Information that we collect
Our website is not intended for children and we do not as a general rule collect data relating to children. MOLA runs youth engagement programmes for young people aged between eight and eighteen years of age in which case we will collect the full names and ages of the attendees, and this is done with the prior written consent of the attendees’ parent or guardian.
When you register with MOLA or its subsidiary project websites (CITiZAN and Thames Discovery Programme), and each time you place an order through our website, MOLA will require some personal data from you - including your name, billing address, delivery address, email address and telephone number and product selections. This information allows MOLA to fulfil your order and notify you of the status of the order. Details of payment card numbers and expiry dates etc go through a secure server operated by MOLA’s Payment Service Provider, Pay Pal, and to which MOLA does not have direct access.
MOLA collects personal data relating to our clients and potential clients in order to carry out our business activities. This includes name, organisation name, email address, business address, phone numbers and any other data that we need in order to carry our contractual obligations. This relates to anyone with whom we have a business relationship, either through our commercial activities or our activities as a charity. This data is not shared with any third parties and is only used for the purposes that the individual would expect. Only information relating to projects that are carried out by our joint venture partnership with Headland Archaeology (MOLA Headland Infrastructure) will be shared with them.
MOLA collects personal data relating to those that engage with our various Research and Education programmes and charitable objectives. This information is only stored when permission has been given by the individual for the purposes of contacting them regarding events, partnerships, training, news and fundraising.
How we collect information from you
Direct from you: where you create an account on our website or subsidiary project websites; purchase our publications; request marketing to be sent to you; sign up to our Ambassador programme; provide your details in order to create business opportunities (including by giving us your business card, contacting us by email, post or telephone on a speculative basis, or regarding an existing contract or project); or perform contracts,
Automated technologies: as you interact with our website, we may automatically collect personal data about your equipment, browsing actions and patterns. We collect this personal data by using cookies, and other similar technologies. We do not use these cookies to identify individuals as they are used for statistical purposes only. You can restrict or block the cookies used by our website through your browser settings but this will impact your user experience. Please see our cookies policy for further details.
Third parties or publicly available sources: we may receive personal data about you from various third parties and public sources as set out below including analytics providers such as Google (based outside the European Economic Area); publicly available sources such as Companies House, the Charities Commission; Gorkana and Glenigan.
Purpose and lawful basis for processing your personal data
We process your personal data in order to provide the services that you have requested (and if you do not agree to this processing, we will not be able to perform our contract with you), or where we have a legitimate interest of furthering our charitable objectives, including through fundraising, and your individual interests and fundamental rights do not override our legitimate interest.
MOLA will always seek individuals’ prior consent before sending direct marketing to an individual’s email address, and when individuals sign up for any volunteering or engagement project opportunities.
Where we process your personal data based on your consent, you have the right to withdraw your consent at any time, and you have the right to opt out of receiving direct marketing communications from us at any time.
Sharing your personal data
Except as specified in this section, we do not pass on your details to any third party (including any local authority) unless you give us permission to do so.
We may share your personal data:
- In the case of projects that are being managed by our joint venture partnership with Headland Archaeology (MOLA Headland Infrastructure), your personal data will be shared with the joint venture partnership to the extent necessary for the management and administration of the project.
- With external service providers, to the extent required for the performance of the services, including our cloud storage provider.
We require all third parties to respect the security of your personal data. We do not transfer your personal data outside of the European Economic Area.
How long do we keep your personal data?
The personal data collected by MOLA is evaluated periodically to determine whether it is current and still needs to be held, and the applicable legal requirements. We store your personal data in accordance with our retention policy.
Data security
We have put in place appropriate technical and operational security measures to prevent unauthorised access to your personal data. We keep our security measures under regular review.
Individual rights
You have the right to:
Request access to your personal data (also called a "data subject access request"). This will allow you to receive a copy of the personal data we hold about you.
Request correction of the personal data that we hold about you. This allows you to have any incomplete or inaccurate data we hold about you corrected.
Request erasure of your personal data. This allows you to ask us to delete or remove personal data where there is no valid reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.
Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information.
Request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in the following scenarios: (a) if you want us to establish the data's accuracy; (b) where our use of the data is unlawful but you do not want us to erase it; (c) where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or (d) you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.
Request the transfer of your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.
Withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.
Lodge a complaint with a supervisory authority, in this case the Information Commissioner’s Office (ICO). You have the right to complain to the ICO and their website is at www.ico.org.uk, but we would prefer if you raised any issues with us first.
Last updated May 2018
