IBCC Privacy Policy

Welcome to the website of the International Bomber Command Centre (IBCC) in Lincoln, UK.

The IBCC is owned and managed by The Lincolnshire Bomber Command Memorial (LBCM) Registered Charity Number: 1144182, Company Number: 07602666 and ZA813653.

Some of our activities, such as our café and corporate events are managed by our trading arm the International Bomber Command Centre Limited (IBCC) which is registered in England under company registration number 10650172 and with the ICO under number ZA815755. Full details can be found at the end of this policy in the ‘Contact Us’ section.

This privacy policy explains what personal information we collect and the reasons why. For the purposes of data protection legislation, the charity LBCM is the Data Controller, meaning it is the charity which is responsible for keeping much of your personal data safe, however, the IBCC is the Controller for employee data, supplier information and shop and retail sales.

For ease of reference, we shall refer to the processing of your information by either the Charity or the trading arm as ‘we’, ‘us’ or the ‘IBCC’.

Who we are and why we need to process personal data

The IBCC is a not for profit organisation created for the sole purpose of providing a world-class facility to serve as a point for recognition, remembrance and reconciliation for Bomber Command.

In order to manage the facility, provide support to veterans, employ and support our staff and volunteers and deliver both community engagement programmes and educational services we need to process personal data. Personal data is also required to manage member relations, organise events and manage donations

Everyone at the IBCC takes the protection of your personal information seriously. We take all reasonable precautions necessary to ensure that the information you entrust to us is held securely and processed in accordance with the Data Protection Act 2018 (DPA), the EU’s General Data Protection Regulation (GDPR), as well as our own internal code of ethics.

This policy sets out the information you need to know to understand how we will process and protect your information.

Why we need your information

We need your personal information to allow us to offer our services to you and to comply with our legal and fiduciary duties.

You can use the following quick links to swiftly find the information you are looking for.

• General enquiries & communications
• Annual passes including Gift Aid declarations
• Donations
• IBCC newsletter subscription
• Membership subscriptions
• Online Shop Purchases including ribbon stones
• Veterans
• Employees
• Volunteers
• Other processing activities and miscellaneous
• How we keep your information safe

General enquiries & communications

In order to manage general enquiries and communicate with you we need to capture your Name, Address, Telephone Number and Email Address.

Usually the information will originate directly from you and therefore, we will record this with your consent, however, enquiries also come to us on behalf of other persons. In these cases, we are careful to ensure, as far as is possible, that the third party whose data is being given to us is aware that their information is being shared. In these cases we shall process your non-sensitive information using the IBCC’s ‘legitimate interests’, and where sensitive information is recorded, the legal basis we rely upon to process your information is the ‘substantial public interest’ clause, and on very rare occasions, where we need to protect the vital interests of an individual, the ‘protecting vital interests’ lawful basis. The latter is especially relevant if we are processing the personal information of vulnerable s, volunteers or staff.

Sometimes an enquiry will require us to share personal data with a relevant third party, such as a veteran’s support group, other voluntary organisation or local authority. Unless a person’s life is in danger, or the law demands otherwise, we will always ensure that you are happy to have your information shared before we do so.

We will retain this information for 3 years after your enquiry and or last contact with us and then securely delete or destroy your information.

Annual passes including Gift Aid declarations

In order to produce and manage annual passes and reclaim gift aid contributions we need to capture your Name, Address, Telephone Number, Email Address, financial details of the purchase and donation, and your photograph for your annual pass.

Usually the information will originate directly from you and therefore, with your consent, however, we recognise someone may purchase the pass on your behalf as a gift. On those occasions we will rely on our ‘legitimate interests’. If a friend or family member purchases a pass for you then we assume you will be aware of the processing when the gift it is presented to you by them. To issue the pass we will need to take your photograph which is taken onsite, and a copy of your image is kept electronically together with your application.

We process your initial application using your consent or legitimate interest, once the annual pass has been issued, we rely on our contractual obligations to manage your subscription, including notifying you of the expiration of your pass. Where gift aid has been claimed we have a legal obligation to retain this information for tax purposes.

With the exception of our third party processor called , https://internationalbcc.digitickets.co.uk/tickets which is the platform used to process your annual pass we will store annual pass information in our server and only share your information with our accountants, HMRC (for gift aid and audit purposes) and any other official government department with whom we must share information, or in any of the miscellaneous situations stated below. It is both our mission and promise that your information will be kept confidential and not shared with any unauthorised third .

We will retain this information for 7 years after your pass has been issued, or last contact with us takes place, at which point we shall securely delete or destroy your information.

Donations

In order to process your donation, we need to capture your name, address, contact numbers, email address and details of the donation.

Usually the information will originate directly from you and therefore, with your consent, although we utilise a number of third party fundraising pages such as Just Giving (https://justgiving.com ), Virgin Giving (https://uk.virginmoneygiving.com/giving/) and Everfund (https://everfund.co.uk ) and they will ask for permission before sharing your details with us. Where Gift Aid has been claimed we need to retain this information for tax purposes and therefore rely upon our legal obligations.

We will retain details of your donation including Gift Aid for 7 years and then securely delete or destroy your information.

IBCC newsletter subscription (post and electronic)

Our newsletters, which are usually issued quarterly, are provided in two formats, either electronically or by post. We will capture your name and either email address or postal address and telephone number, together with details of any consent or permission you give to us.

As you will have subscribed for the newsletter, either through our website, in , or over the telephone, you are deemed to have given your consent to us processing your details, however you have the right to withdraw your consent at any time which you can do by using the unsubscribe option in the footer of every electronic email, or by writing to us or calling us using the contact details at the end of this privacy policy.

We will process your information to only manage your newsletter subscription and will not share it with any third parties. The only exception is that we utilise an to send out our email newsletter and this company may be based outside of the EEA. We may also need to share your information if there is another lawful reason, for example with HMRC.

Your details will be securely deleted if you unsubscribe from the Newsletter or after 3 years if no communication is sent to you. If you unsubscribe a do not contact list will be maintained and anonymous data will be retained for statistical purposes.

Membership subscriptions (post & web)

In order to process and look after your Membership with the IBCC we need to capture your Name, Address, Telephone Number and Email Address.  We will also assign you a Membership Number and the Renewal Date of your Membership. During your membership with us if you make any enquiries or we have any communication or correspondence, and it is felt appropriate details of our interactions will be recorded. We are constantly trying to improve our service and from time to time we also perform a survey of our annual members; this will be performed by our staff but using an external third-party survey platform.

We will process your information relating to your membership under the lawful basis of ‘contractual obligation’ and promise that we will never share your details with any third parties. The only exception is that we utilise an email broadcast company to stay in contact with our members and this company may be based outside of the EEA. We may also need to share your information if there is another lawful reason, for example with HMRC.

If you cease to be a member, which we sincerely hope will not as be the case as your support is invaluable, we will retain any records relating to finance for a period of 7 years and all other information will be retained for 3 years from last inbound contact or your membership cancellation.

Online Shop Purchases including ribbon stones

To deliver purchases which you make from our Online Shop we will need to capture your Name, Address, Telephone Number and Email Address. If we are sending purchases these to a different recipient or address, we will also record details of the individual to whom the item is to be dispatched.

If you are purchasing a ribbon stone, then we will collect your name and contact details plus details of the memorial.

We will process the information relying on both your ‘consent’ or to fulfil our ‘contractual obligations’.

To facilitate online payments, we utilise a highly respectable third-party payment company called WorldPay. To pay for your online purchase you will be transferred to the WorldPay website to complete the sale. The IBCC do not control or see any of the card details which will be used to complete the transaction. You should read the WorldPay privacy notice for more information about how they keep your information safe as they will act as the Data Controllers for any payment information you share with them.

Our Electronic Point of Sale (EPOS) and internet shopping purchases are managed through a third-party processor called Digitickets. https://internationalbcc.digitickets.co.uk/tickets

We will retain finance details for 7 years from the transaction date and more general details of any sales for 3 years from the date of the .

Veterans

In order for us to manage our ongoing relationship and communications with you and to ensure that we have an accurate historical record of the contribution our veterans made, and continue to make, and to ensure that archival records are correct we need to capture your Name, Address, Telephone Number and/or Email, Trade and Rank in Service, Squadrons served, your Third Party Contacts, Interview Details and Notes of your Service given by you to our team.

Usually the information will originate directly from you and therefore, with your ‘consent’, however, information and enquiries also come to us by family members, friends or other third sector organisations or associations. On those occasions, we are careful to ensure that you are aware that your information is being passed to us, we are processing that information in the ‘substantial public interest’ or in the ‘legitimate interests’ of the IBCC.

Occasionally requests are made to divulge your personal data, however, we will never do this without gaining your consent unless we think that it is for your safety and security, in this last case, if we are very worried about your physical or mental health or wellbeing we can share your information to protect your ‘vital interests’.

We will hold this data indefinitely unless you or your legally appointed representative request your details are removed from the records. Sadly, each year the number of veterans, or in our eyes VIP’s, decreases, data protection laws only applies to living individuals, but we will always treat any information relating to our veterans with extreme sensitivity and care.

Employees

In order to protect you whilst you are in our employ, ensure your safety and wellbeing, comply with employment and tax regulations and make payments to you, we need to capture your Name, Address, Telephone, Email, Medical Details, Next of Kin contact details, Financial and Pension details, and, where applicable, copies of records such as Passport, Driving Licence, Personal Licence, Relevant Qualifications and DBS Checks. References may be sought as well as confirmation with third parties to confirm your right to work.

We will process the above and other information related to your employment including contracts, manual employment records, appraisal forms, holiday, sickness and grievance and disciplinary and other work-related information. To prevent discrimination and ensure diversity we may request information from the data subject on religion, sexuality and ethnicity.

This information will have come from you via your employment record cards, which you will be asked to update annually; much of the information we require to manage your employment relationship is required by law although some non-essential information such as details of next of kin will be processed with your consent.

We will keep your main employment information on file for 7 years after employment ends.  However, some information, such as pension details, legal claims etc may be kept indefinitely.

With the exception of HMRC or any other official government department with whom we must share information, or in any of the miscellaneous situations stated below, your information will be kept confidential and not be shared with any third parties.

Volunteers

In order to manage our relationship with you, deliver our duty of care to you whilst you are a Volunteer and keep our veterans safe we need to capture your Name, Address, Telephone Number, Email Address, Volunteer number, DBS result (for certain volunteers only), Medical information and Next of Kin details plus a record of your engagement. This will enable us to ensure your and other colleagues and service users’ safety and provide information for medical emergencies.

Your information will come directly from you via your volunteer agreement, which you will be asked to update annually, we will process the information with your consent and in some case using our ‘legitimate interests’ and ‘legal obligations’.

We will normally destroy your records 3 years after receipt of a written resignation although in exceptional circumstances some specific elements of the file may need to be kept for other legal reasons.

Other processing activities and miscellaneous

Vulnerable persons

Given the nature of our organisation we deal with a lot of veterans, senior citizens and vulnerable persons. We have processes in place to ensure that where a vulnerable individual is identified, additional precautions are taken to protect their personal information.

Children

We do not actively process data on children under 18. Children are welcome and encourage to visit the centre with school and youth groups or as part of a family or with an adult. The child’s name is not linked to any pass issued by us.

No register or record is taken by us for schools or youth groups.  It is held by the teacher and we do not take a copy

Medical health information

Some of our visitors have significant health challenges and in order that we can tailor services to their needs such as facilitating disabled access, especially when we are organising a structured event in which everyone regardless of health or physical capability is invited, some sensitive information relating to health may therefore be processed. We will only do this with your (or your advocates) explicit permission and will only share any information in the event of an emergency, for example when we may need to pass the information to the emergency services or a first aider.

This information will only be retained for the duration of the event unless an incident occurs in which case some record of the incident may need to be retained for legal reasons.

CCTV and surveillance cameras

In order to prevent and detect crime, and to ensure the safety of our members and staff, we operate CCTV systems at our main site. These cameras record footage in real-time and are operated and controlled by our own staff. Monitoring and recording does not take place in any sensitive areas and unless a specific extraordinary situation took place we would never use covert filming, monitoring or use audio recording in surveillance devices.

CCTV footage overwrites approximately every 28 days. Access to CCTV footage will only be shared with statutory bodies such as the police on receipt of a written request or in the event of a crime taking place in real time, and would only be released to individuals if an access request was made and no other third parties could be identified within the footage.

Some filming of events may take place, but notices and announcements will take place advising attendees of this fact. Individuals should make themselves known to the organisers if they do not wish their image to be captured.

Marketing and social media

We may from time to time identify local businesses that we wish to contact for sponsorship or collaboration purposes and may identify contacts within those businesses from public domain information including the web, local press and media. We shall only collect a name and business details together with contact information and delete the information 3 years after the last interaction or immediately if asked to do so.

We utilise social media to promote the great work we are doing here at the IBCC and will manage all of our social media accounts strictly in accordance with any current relevant legislation.  Contacts must be aware that any posts or messages sent via a social media platform (or indeed the Internet in general) are not secure and what you write may be visible to a wider audience than you intended.

If we post any images online which can identify living individuals, we shall ensure appropriate consents have been obtained.

Anonymous user data is recorded when users visit our and social media platforms, please visit our cookie policy for full detail on how we utilise cookies and Google Analytics.

Suppliers and business contacts

In order to promote the activities of the organisation and manage it operationally, business relationships will be formed with other third sector organisations, local authorities, business groups, individual organisations and other private interested parties.  We will collect name, contact, financial information and organisational details together with a record of any interactions, communications and correspondence between these parties. In the course of business, we will also both generate and receive invoices and other financial transactions.

We shall rely on both our legitimate interests and consent to process the personal data elements of our interactions, and in terms of financial matters how legal obligations.

Information shall be deleted 3 or 7 years after our last business dealing depending on whether a statutory requirement to maintain information is placed upon us.

Legal and professional advice

In the event that legal, tax or professional advice is required we will share with the other party the minimum amount of personal data necessary in order to achieve the intended outcome. If invoices become overdue, then the services of a professional debt collection company may be sought. In both of these cases we shall rely on our right to take or defend a legal claim and pursue our legitimate interests and contractual rights to pursue outstanding debts.

Policy updates and change of ownership

From time to time minor amendments may be made to this policy and we would encourage you to review this document for updates. In the event that a significant change to how we process your data takes place we will notify you individually.

In the event that the organisation is taken over or acquired or merged with another organisation your data will be transferred to the other party however they will contact you in order to advise you of the change and offer you the opportunity to opt out of processing at that time.

How we keep your information safe

Wherever possible your personal information will be hosted securely within the UK or the EEA.  If we transfer your information to a data processor, for example, to our email broadcast company to assist us in keeping you up-to-date with announcements, news and information, and they are located outside of the EEA, we shall take all reasonable steps to ensure that your information is protected as just as if we hosted it ourselves.

We shall put in place appropriate but proportionate technical and organisational measures to keep your personal data safe and secure, we shall ensure that all staff and volunteers are appropriately trained in data protection and where any data sharing takes place appropriate contractual documentation or data sharing agreements will be put in place to safeguard those data transfers.

Archives

The LBCM collaborates with the University of Lincoln to maintain our historical archives which contains both video and audio footage of veterans and other contributors. The University of Lincoln is responsible for the management and security of archives however work closely in unison with us to determine how historical records can be used, for what purpose and who may have access.

Content within our archives is obtained and managed with the consent of all living parties involved and will be maintained indefinitely for historical public interest purposes.

Lawful Basis overview

Your rights

Data Protection legislation affords individuals certain rights in relation to the personal data processed about them, these are listed below for your convenience:

Right of access to Information
You have the right to access a copy of the personal information we hold about you by making a Data Subject Access Request (DSAR), you can do this by phone, in writing or by email to the contact details shown at the end of this Privacy Policy.

We will just have to verify your identity before we can proceed.

Right to rectification

You have the right of rectification to amend or update your personal information and ensure we maintain accurate and up to date records and or data about you.

Right to erasure

You have the right to erasure, also known as ‘the right to be forgotten’. The broad principle underpinning this right is to enable an individual to request the deletion or removal of personal data where there is no compelling reason for its continued processing by the IBCC.

Right to restrict processing

You have the right to ‘block’ or suppress the processing of your personal data. Processing of your personal information may be restricted in the event it is no longer essential to support the use of services provided to you and is no longer needed for any contractual, legal or financial reasons. In those cases, Griffin House is permitted to store the personal data, but not further process it. We may retain just enough information about you to ensure that any restriction is respected in the future.

Right to data portability

You have the right to data portability which allows individuals to obtain and or reuse their personal data for their own purposes across different services. It allows you to move, copy or transfer personal data easily from one IT environment to another in a safe and secure way, without hindrance to usability.

The right to object

You have the right to object to the processing of your personal information based on consent, our legitimate interests or the performance of a task in the public interest or exercise of official authority including profiling activity, direct marketing including profiling activity; and processing for purposes of scientific and or historical research and statistics.

Right to object to direct marketing

You have an absolute right to ask us to stop sending you direct mail or marketing emails.

The right to object to automated decision making and profiling

You have the right to be made aware of any automated decision-making, that is decisions to be made without any human involvement, and/or profiling of your personal information by IBCC, for the avoidance of doubt, the IBCC do not perform any automated decisions on you or process to mark papers, but this is simply a scoring system, decisions are not made on you which will affect you in a legal way.

For some processing you will have given us permission to process your information, and in these cases you can withdraw your consent at any time however but we may still need to keep the information processed under your consent for other legal reasons.

In certain situations, the above rights may not apply, for example if you entered into a membership minimum term contract, we may have to write to you about your membership even if you asked us previously not to, but in this case we would not send you any further direct marketing communications.

Contacting us

if you have any questions or concerns about this policy or how we are processing your information, or would like to activate any of the rights listed above simply get in touch with us using any of the following communication channels.

By email to info@internationalbcc.co.uk

By telephone on 01778 421420

Or write to us at: IBCC, 13 Cherry Holt Road, Bourne, Lincs, PE10 9LA

The Lincolnshire Bomber Command Memorial (LBCM)
Charity registered in England Number: 1144182

Registered company 07602666
Registered with the ICO registration number: ZA813653

International Bomber Command Centre Limited (IBCC)
Company registered in England Number 10650172
Registered with the ICO registration number: ZA815755

The IBCC and LBCM registered office is: International Bomber Command Centre, Canwick Avenue, Lincoln, England, LN4 2HQ

Information Commissioner’s Office

Finally, if you are unhappy with how we have processed your information, or you have any concerns which we have been unable to address, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO) whose contact details are as follows:-

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire, SK9 5AF

Helpline: 0303 123 1113 (local rate) or +44 1625 545 745

Website: https://ico.org.uk/make-a-complaint/

Policy version 1.1 December 2020