Privacy Notice - Borthwick Institute for Archives, University of York

Privacy notice - Borthwick Institute for Archives

Who we are

The Borthwick Institute for Archives is an archive repository and service. We are part of the University of York, which is the responsible ‘data controller’. The University was incorporated by royal charter, with a mandate to 'advance learning and knowledge by teaching and research, and to enable students to obtain the advantages of University education'. The Borthwick’s mission is to support and expand the University's cultural endeavour and contribute to human understanding through collecting archives and special collections, preserving them and making them widely available for research to all people, now and in the future.

We make our archive, art and rare book collections, our search rooms, finding aids, publications and resources available to the widest possible audience. To provide and improve our services we need to process some personal information from our visitors, users, donors, stakeholders and those who appear in the archival records we hold.

This privacy notice explains what you can expect us to do with your personal information when you make contact with us or use one of our services. It applies to information we collect about people who engage with us through the use of our services, sites and collections. Information on how the University processes the personal information of staff, students and visitors more generally can be found in its suite of privacy notices.

Where do we get your data from?

The Borthwick collects information about you in a variety of ways. These include:

Via our websites and online services, when you

access our online content (information on the use of cookies is given on the relevant site)
contact us, or respond to surveys or submit enquiries
register with, or purchase our goods and services from, the University’s Online Store
contribute or upload material to our websites in a professional or voluntary capacity
contribute to our websites (e.g. Cause Papers online), or add comments or enquiries on our blog or social media

When you use our services or participate in our events/activities:

sign-in as a reader and agree to the searchroom rules
make a purchase from us (in person or by using the online store), by buying digitised images or transcripts, downloading archival records, paying for research or digitisation services, licences or publications
contact us with an enquiry or a complaint, provide feedback, complete a data protection researcher agreement, ask for information we have about you (a subject rights request), or submit a freedom of information request
book for our events, talks and exhibitions, classes or placements
book one of our rooms
subscribe to our publications
sign-up for a volunteering, work experience or internship placement / opportunity
attend an onsite tour or event as part of a group or class
sign-up to a mailing list
gift, transfer or deposit archive or research material or collections, or correspond with us about their loan, use or exhibition
engage with us professionally, for example, collaborate in professional or academic activities, partnerships or networks
visit our premises
undertake tasks for us: staff, contractors, consultants, and volunteers (for information about how the University processes the personal information of job applicants, staff and students, please see the privacy notices on the Data Protection website.

When you visit the University campus:

the University collects some information about visitors to University premises, including its car parks, event and educational spaces (e.g. via CCTV) and from people who sign up to its public wi-fi network. More information about its processing of personal data can be found in the privacy notices displayed on campus and at https://www.york.ac.uk/records-management/dp/your-info/

From the archives and collections given and transferred to us:

we hold and process the personal information of people who appear in our archival collections (analogue and digital) which are transferred to or deposited with us by the creator/owner of the archive.

What data do we have and how do we use it?

We currently collect and process the following information.

People who use and support our services and resources

Your name and address, a record of the date and times of your visit, and the documents you ordered. We use this to record your attendance and which records you have accessed to have an audit trail in the event of records being missing, lost or damaged, to record your agreement to the searchroom rules, to provide you with access to original archival documents in our searchroom, and to safeguard the integrity of our collections.
Your contact details and the details of your interactions with us (e.g. the record of your enquiry, request, offer or complaint). We use this information to enable us to answer your queries or complaints or to respond to requests and offers of material, manage room bookings and tours.
Your contact and order details, transaction and payment information, and records of your interactions with us concerning your order/use of our services. We use this information to arrange and manage any contracts for the provision of services or products (e.g. copying or research services, purchases from the Online Store or at the reception desk). We do not generally hold bank account or credit card details as payments are processed through the Online Store or a point of sale device.
Your contact and registration/attendance details, and any feedback you provide for workshops, programmes or events you register for or attend. We use the information to administer your attendance and the event and for statistics.
Your contact details and terms on which you have donated, deposited, loaned or transferred collections or items to us, so that we retain a record of how a collection or item(s) were acquired, from whom and on what terms.
Records of your visits to the archive, to the sites, or at the events we host (singly or jointly with another organisation), and any feedback you provide. We use this to gather feedback, understand the user experience, conduct research and data analysis and to develop statistics to help us understand the use made of our collections, sites and buildings, and to chart the response to, or impact of, our events and projects. We also use the information to develop and tailor our services and communications.
Your name, contact and subscription details and marketing preferences. We use this to send you relevant marketing information which you have requested from us or which we think you might find useful – including information about new publications and events.
Your name, contact details, CV/application information, visa status, and criminal record declaration, when you volunteer for us. We use this as part of the recruitment process, and to enable us to support volunteers and provide suitable placements and volunteer opportunities in line with our legal responsibilities and University policy.
Where you provide information about your physical or mental health (including any injuries) or disability status, we use this information to ensure your health and safety when using our site or participating in any of our events (e.g. to provide reasonable adjustments, in the event of an incident, or to meet your dietary requirements).
Images in video and/or photographic form. We may photograph or record events and use this information for promotional purposes and as an historic record.
CCTV footage, records of your attendance and other information obtained through electronic (e.g. door access records for staff cards). We use this information to comply with health and safety requirements and for security purposes, including safeguarding the security of our visitors, staff and the archives in our care.

People in our archival collections

The Borthwick Institute has a mandate to preserve the archives of the University and other historic records (including public records) permanently, and to make the records available for use. Information on our collecting mandates, how we manage archives and develop collections, is contained in our policies. The University’s Records Management policy covers the selection of University records for permanent preservation. We provide professional advice to University departments, donors and depositors as to whether documents are worthy of archival preservation (i.e. have lasting value for the research and understanding of history and the present, or for the protection of legitimate interests of citizens or for purposes of legislation, administration and jurisdiction).

We hold archives that span the period from the middle ages to the present day. We provide descriptions of our collections in our online catalogue. The archives include personal, business and family records, such as minutes, correspondence, parish registers, financial and medical records, files, photographs, video and sound recordings, and websites. They are in a range of analogue and digital formats.

We collect and preserve these archives so that we can provide access to them. While we seek to make them accessible to the widest audience possible, we must balance access against statutory and contractual obligations, public and private interests, and the preservation needs of the records.

Some of the more recent archives we hold contain information about living people: personal information that has been acquired by the organisations/individuals that have donated, deposited or transferred their records to the Borthwick Institute. Your information will be handled according to the safeguards built into the data protection legislation for archiving in the public interest. This means that we apply the same standards to handling this information, except that some of your rights have a limited application: see the section ‘What rights do you have in relation to your data?’ below.

We use a web archiving service, Archive-It, to collect, preserve and provide access to snapshot versions and content from public websites that complement our existing collecting areas and University research interests. The websites we harvest and preserve are selected on an individual basis in line with our collections policy. Please contact us if you have any questions or concerns about our archived web content or copyright.

People who use information about living people from the archives have a duty, under data protection legislation, not to use that information in a way which may cause distress or damage to those concerned or inform decisions relating to them. You should also be aware that, just because information is in the public domain, it does not necessarily make it lawful for you to share it or make it public. The documents that fall into this category are generally less than 100 years old. We will let you know when this restriction applies and will ask you to sign a Data Protection Researcher Undertaking. We may also seek confirmation of ethical approval for academic research projects involving special category data. Personal information and our archival records may also be subject to copyright restrictions.

To calculate when personal data that is closed for a person’s lifetime can be opened, we assume a lifespan of 100 years. This may result in information on people who are aged over 100 being made public. If this is the case, please contact the Borthwick Institute and we will remove your information from public access.

What is our legal basis for processing your data?

As the data controller, the University of York must have a legal basis for collecting and processing your personal data for all these activities under data protection legislation.

We collect, catalogue and make available our collections, and process the personal data held in them, because the processing is necessary for the performance of a task carried out in the public interest (or in the exercise of our official authority, such as under the Public Records Act 1958 or Parochial Registers and Records Measures of 1929 and 1978). More information on these official authorities is set out in our policies and archive repository description. As an accredited archive repository a key part of our public task is to secure and to make accessible the historical records in our custody and to deliver our services as widely as possible for the benefit of society.

Depending on the circumstances (e.g. for marketing), we may also process your personal information because you, or your legal representative, have given us your consent (which you can withdraw at any time).

Consent is not the only legal basis under which we can acquire and process your personal information. We do not require your consent to process your personal information if

you have entered into a contract with us (e.g. for the provision of any services or products, events or classes)
you have made this information publicly available yourself
it is required by law
it is necessary for legal cases
it is necessary to protect someone in an emergency
it is to the benefit of the public in general
it is necessary for employment purposes
it is necessary for our legitimate interests
it is necessary for archiving, research, or statistical purposes, so long as certain conditions are met.

Who do we share your data with?

We may share your data with third parties that process data on behalf of the University of York to support us in fulfilling our obligations and responsibilities to you and our public task (e.g. DeepStore, and software and system providers including but not limited to Archive-It (a service from the Internet Archive), Google and DocuSign).

We allow some third party publishers, (e.g. Ancestry, Wellcome and Findmypast), to digitise, or host digitised copies of, some of our archive records for online use. We and our publishers make every effort, taking into account the content and condition of the material, to avoid putting personal data online, especially any personal information that may cause damage or distress to living individuals.

The University of York will not share your information externally for any other purposes without your consent unless exceptional circumstances apply. Any such disclosures will be made in full accordance with the data protection legislation and only where necessary.

How do we keep your data secure?

The University takes information security extremely seriously and has implemented appropriate technical and organisational measures to protect personal data and special category data. Access to information is restricted on a need-to-know basis and security arrangements are regularly reviewed to ensure their continued suitability. For further information see, https://www.york.ac.uk/it-services/security/.

How do we transfer your data safely internationally?

In certain circumstances, it is necessary to transfer your Personal Data (including Special Category Data) outside the UK. In respect of such transfers, the University will comply with our obligations under UK GDPR and ensure an adequate level of protection for all transferred data.

How long will we keep your data?

We will retain your data in line with legal requirements or where there is a business need. Retention timeframes will be determined in line with the University’s Records Retention Schedule.

Personal data contained within the archival records in our collections will be retained permanently or for as long the relevant records are in our care.

What rights do you have in relation to your data?

Under the UK GDPR, you have a right of access to your data, a right to rectification, erasure (in certain circumstances), restriction, objection or portability (in certain circumstances). You also have a right to withdraw consent.

If you would like to exercise any of these rights, please contact us at borthwick-institute@york.ac.uk. Further information can be found on our subject rights requests website.

Please note that for personal data processed for archiving purposes in the public interest, in accordance with Article 89 (1) of the UK GDPR, the right of access to your data, right to rectification, erasure, restriction, objection or portability will not apply to the extent that applying the rights would prevent or seriously impair the achievement of those archiving purposes.

Questions or concerns

If you have any questions about this privacy notice or concerns about how your data is being processed, please contact us at borthwick-institute@york.ac.uk in the first instance.

Right to complain

If you are unhappy with the way in which the University has handled your personal data, you have a right to complain to the Information Commissioner’s Office. For information on reporting a concern to the Information Commissioner’s Office, see www.ico.org.uk/concerns.

Changes to our privacy notice

We keep our privacy notice under regular review. This notice was last updated on 20th September 2022.