Who we are
Creswell Crags exists to inspire a love of the natural world and seek to find out more about our prehistoric
The Creswell Crags Trading Company (CTC) carries out the commercial activities of the Museum (eg retail and café.) As a wholly owned subsidiary, CTC is subject to the Museum’s policies and procedures.
In this privacy notice and in the data protection statements which you will see wherever we collect your personal information, ‘Creswell Crags’, ‘the Museum’ and ‘we’ refer to Creswell Crags and Creswell Crags Trading Company.
The Museum is the data controller of your personal information.
How we use your information
When you give us your personal data we will explain specifically how we will use it in a fair processing statement with a link to this privacy notice. The main purposes for which we collect and process the details of customers, suppliers, volunteers, visitors, Members, service users, enquirers, donors and potential donors are to provide the service, goods or information that you have requested:
- for administration purposes (eg to administer donations, and to keep a record of our relationship with you)
- to further our charitable aims, including fundraising activities
- to gather feedback
- to enable the best possible supporter journey and experience
We may use your data to contact you by email (if you have given us your consent or are a business contact), post or phone with news and information about the Museum that we feel may be of interest to you as well as about our other special events, activities, products and services. We will not use your personal information in this way if you have opted out, unsubscribed or otherwise indicated that you do not wish to be contacted for such marketing purposes.
Cookies and tracking
When you visit www.creswell-crags.org.uk, or crags-shop.com, we collect standard internet log information and details of visitor behaviour patterns. We do this to find out, for example, the number of visitors to the various parts of the site, to compile statistical reports on website activity and to personalise our visitors’ website experience.
If we would like to collect personally identifiable information via the website or other digital channels, we will make it clear when we do so and will explain what we intend to do with the data.
Wi-Fi service and other sensing systems
We operate a Wi-Fi system at Creswell Crags. Free Wi-Fi access is available throughout the Museum via the network named ‘crags’. If you access the Museum’s free Wi-Fi network, you will be asked to agree to the Museum’s Wi-Fi terms and conditions of use, which explain how your data will be used.
If you do not use the free Wi-Fi network but have Wi-Fi enabled on your smartphone, tablet or another internet-enabled device, your device can still be detected by the Museum’s Wi-Fi service.
We record anonymous data about the location and type of devices in the Museum that have Wi-Fi enabled and other sensing data, for security and so that we can monitor the flow of visitors around the Museum and improve our services.
We will not link the anonymous device data with any other personal data that identifies you individually without your express permission. If in the future we want to process your data in this way to offer you new services, we will ask you via a consent form before doing so.
Conditions under which we use your information
We follow the principles of fair and legal processing described in the General Data Protection Regulation. We will only process personal data under one of the available lawful conditions (legal bases) – for example, if:
- You have consented to the use of your personal data for the specific purpose in question, such as for a particular type of marketing.
- We need to process your personal data in order to deliver a contracted service, such as when you buy a ticket for an event or become a Member
- We are entitled or required by law to process personal data in a certain way, such as for fraud or crime prevention
- We need to protect the vital interests of any person
- We are required to process personal data in performance of a task carried out in the public interest or in the exercise of our official authority, such as in the management of the collections, or using CCTV to protect the Museum and its visitors
- The processing of personal data is within our legitimate interests, where we carry out activities that would not be considered to fall into the definition at (e) above, but are enabling the Museum to meet its objectives as laid out in legislation
This may include:
- marketing, publicity and fundraising mailshots that do not require consent (eg postal or phone contact from Development and Communications staff or business to business communications)
- prospect research prior to first contact
- due diligence research on potential donors
- visitor and customer analytics
- exercising or defending legal claims
Visitor and customer analytics and prospect research
It is within the Museum’s legitimate interests to hold and analyse your data to continue to improve our understanding of our target audiences and supporters. This is so we can provide world-class, transformative, visitor-focused experiences, customer service and educational engagement, and effective and appropriate supporter engagement. We are also looking at how we might in the future use the latest technologies to improve and personalise the services that we offer.
Visitor analytics data is collected on an anonymous basis wherever possible, or pseudonymised so that individuals cannot be readily identified. This includes monitoring visitor numbers and tracking movement of people and collections of individuals around the Museum. (For more information see sections on cookies and Wi-Fi.)
We carry out customer analytics to improve our understanding of our target audiences. We do this by analysing your commercial transactions (eg ticket and retail purchases) and activities (eg email interaction with the Museum, use of Museum Wi-Fi). This helps us target our marketing more efficiently, and personalise and improve your experience if you have consented to receive marketing from us, by providing the most relevant and timely content.
You can object to our carrying out this kind of activity for marketing purposes by using this form, and we will review our basis for doing so in your case. Please note that objecting to this activity will mean that you are automatically unsubscribed from marketing.
Prospect research (that is, building up a profile of a particular individual, their interests, suitability and likelihood they will donate to the Museum) is fundamental to the ability to generate income through fundraising, as the Museum is expected to do. We may therefore analyse personal information collected from you, from publicly available sources and occasionally from third parties, to create a profile of your interests and preferences.
This helps us understand the background of the people who support us, and enables us to contact you in the most appropriate way, with the most relevant information. You can object to our carrying out this kind of activity for fundraising purposes by emailing
Who we share information with
We will never sell your data. We will not share personal data with third-party organisations for marketing purposes without your permission. We may, however, occasionally outsource functions when we do not have the in-house capacity required, such as the use of a mailing house for mailings, companies that run competitions on our behalf and analytical services that enable us to target our communications with customers and supporters more effectively.
In such cases the personal data will only be processed in accordance with our lawful instructions, and we will remain controller of the data. We will only use reputable and vetted firms and have contracts and processes in place that ensure the safe and confidential processing of personal data at all times.
We may also disclose personal information where required by law or where otherwise necessary for a lawful purpose.
Transfer of data abroad
We will always ensure an adequate level of protection is provided for personal information transferred outside the European Economic Area. If the organisation we share personal data with is in a country without adequate data protection in place, we will place contractual requirements on the third-party organisation to handle personal data to the same standard that is required by legislation in the United Kingdom.