We are a registered charity formed in 2012 to care for 2,000 miles of historic inland waterways across England & Wales. Our vision is for living waterways that transform places and enrich lives.
Organisation details
We are committed to protecting the privacy of all those individuals whose personal information we process. This Privacy Notice and accompanying Privacy Schedules explains how we collect, manage, and use such information.
Registered office: National Waterways Museum Ellesmere Port, South Pier Road, Ellesmere Port, Cheshire, CH65 4FW
Information commissioner registration number: Z3116902
Data Protection Officer: Tom Deards, legal and governance director. Contact: [email protected]
Charity registration number: 1146792
Privacy Schedules
This Privacy Notice should be read together with the Privacy Schedule relevant to our relationship with you. These schedules set out in more detail the nature of our information processing and are listed at Annex 1.
Personal information is information that is about you or that otherwise concerns you, from which you can be identified, either directly or indirectly in combination with other information.
The Trust needs to collect and use personal information to fulfil its functions, provide its services, and operate effectively. Depending on our relationship with you, we are either the controller or the processor of your personal information.
If you are 16 or under
If you are aged 16 or under, you must obtain permission from your parent/guardian before you provide any personal information to us.
Lawful basis
Your personal information will only be processed where we have identified a lawful basis to do so, pursuant to a special condition as set out in Article 6 of the UK General Data Protection Regulation (UK GDPR). The lawful basis we rely on are as follows:
Lawful basis
| Consent | Where you have consented to the processing of your information. Where we rely on this lawful basis you will have a right to withdraw your consent at any time by contacting the individual or Trust department set out in the consent documentation or: [email protected] |
| Contract | To fulfil the obligations of any contract we have with you, or in anticipation of such a contract. We rely on this lawful basis where we are unable to administer or fulfil the contract and associated tasks without processing the information. |
| Legal obligation | To fulfil our legal obligations, for example compliance with legislation or statutory regulations. We rely on this lawful basis where we are under a statutory duty to process the information. |
| Vital interests | Where the processing is necessary to protect an individual’s life. |
| Public task | Where the processing is necessary for us to perform a task in the public interest, or in pursuance of our official functions. |
| Legitimate interest | Where there is a legitimate interest to process the information. This could be our interest, your interest or a that of a third party. Where we rely on this lawful basis, we will have balanced the legitimate interests against your data protection rights by way of a Legitimate Interest Assessment. |
We may process your special category information, such as:
| Racial or ethnic origin | Genetics and biometrics (where used for identification purposes) |
| Religious or philosophical beliefs | Health and disabilities |
| Political opinions | Sex life |
| Trade union membership | Sexual orientation |
Where we process this information, it will only be for legitimate Trust business purposes and pursuant to a special condition as set out in Article 9 of the UK General Data Protection Regulation (UK GDPR) and Schedule 1 of the Data Protection Act 2018 (DPA). See ‘special conditions’ section below for more information.
We may process your criminal records and offences information. Where we do, it will only be for legitimate Trust business purposes and pursuant to a special condition as set out in Article 10 of the UK General Data Protection Regulation (UK GDPR) and Schedule 2 of the Data Protection Act 2018 (DPA). See ‘special conditions’ section below for more information.
Special conditions
The special conditions relied upon for processing special category and criminal convictions and offences information are as follows:
Special conditions
| Explicit consent | Employment, social security, and social protection authorised by law |
| Vital interests | Made public by the data subject |
| Legal claims or judicial acts | Reasons of substantial public interest with a basis in law |
| Health or social care with a basis in law | Public health with a basis in law |
| Archiving, research, and statistics with a basis in law | |
Your personal information will be stored in a range of different places in the Trust’s information management systems. These are set out specifically in the relevant Privacy Schedule.
We operate technical and organisational measures to ensure the security of all personal information that we hold. We review these measures regularly to make sure they remain appropriate to the type data and method of processing.
Your information is stored in a secure environment and is only accessible by authorised personnel who have a legitimate reason to do so.
We will only process your personal information for as long as it is required for the purposes for which it was collected. We may keep it longer where we are required to do so, for example by law or regulation or for legitimate business reasons.
We review our processing of personal information on a regular basis and securely delete or destroy that information when it is no longer needed.
We may share your personal information, either internally within the Trust or externally with our partners or other organisations for legitimate purposes.
We will only share information with a third party where it is lawful to do so under the UK GDPR and the DPA, for example where there is a lawful basis, special condition, or where there is an exemption provided by the DPA. We also ensure that the recipient has measures in place to use and protect the information in line with UK GDPR requirements, as may be set out in contractual clauses or data sharing agreements.
We may share your information internationally depending on the nature and purpose of the processing. Where we do so, it will be subject to appropriate data protection safeguards as assessed by a Transfer Risk Assessment, including adequacy decisions, contractual clauses, and the UK International Data Transfer Agreement.
Automated decision making
We do not carry out any activities using automated decision making.
Location data
Our websites use your location data to provide you with more relevant content specific to your local area, however no automated decisions are made during this process. Please see our Privacy Schedule for website cookies for more information.
Where appropriate, we will keep a record of your contact and communication preferences, to ensure that you maintain control over how we contact you, and that we only provide you with information that you are interested in. Depending on our relationship with you, you may not be able to opt out of certain communications, for example where they are vital to you as an employee or volunteer.
Direct marketing
We will only send you marketing communications where you have consented to receiving such, or where you have previously indicated an interest in our services and our work. You have a right to opt out of this marketing at any time by contacting the individual or Trust department set out in the consent notice, or via email to [email protected]
Legal matters
We may process your information to instigate or defend legal proceedings and may be required to share your information with legal authorities where such is required for the purpose of legitimate business, for example the police and HMRC.
Your individual rights
The following are your individual information rights:
-
Right of access - the right to access the personal information we hold about you.
-
Right of rectification - the right to have inaccurate information corrected.
-
Right to restrict processing - the right to limit the processing of your personal information in certain circumstances, for example, whilst a complaint about its accuracy is being resolved.
-
Right to object - the right object to your personal information being processed.
-
Right to erasure - the right for personal information to be deleted.
-
Right to data portability - the right to have your personal information provided in a machine-readable format to ensure its portability.
- Right to withdraw consent - the right to withdraw consent to processing personal information, where consent is the lawful basis. See individual consent form and/or the relevant Privacy Schedule.
The Trust is obliged to respond to Individual Rights Requests under the UK GDPR and the DPA.
Please note that some of these rights are not automatic, and we may legitimately decline to action some requests depending on the circumstances. Further, exercising some of these rights could impact on our continued relationship with you and the provision of our services. Should either of these be the case, you will be given more details at the time.
To comply with a request, we will exhaust all avenues where information is held, including emails, OneDrive, Teams, and SharePoint, to ensure that a complete response is provided. To do this, we may use a Microsoft tool to interrogate our systems for these documents, rather than a manual process.
If you wish to exercise any of your data protection rights, or make an enquiry or complaint about how we have handled your personal information, please email [email protected].
We also encourage you to let us know if your personal information changes, or if you think the personal information that we hold is wrong or out of date.
If you are not satisfied with our response to any query you raise with us, or you believe we are processing your personal data in a way which is inconsistent with the law or your data protection rights, you can complain to the Information Commissioner’s Office at www.ico.org.uk or by calling 0303 123 1113.
We encourage you to contact us before making a complaint, and we will seek to fully resolve any issues or concerns you may have.
Changes to this Notice
We may change this Notice (or the individual Schedules listed in Annex 1 below) from time to time without notice to you. This is to ensure they reflect current legislation. In that case, the ‘latest version’ date in Annex 2 (below) will also change. Any changes to this Privacy Notice will apply to you and your data immediately.
If these changes significantly affect how your personal data is processed, we will take reasonable steps to let you know.
Latest version
This Privacy Notice is reviewed periodically when changes are required, and in any event every three years. If the version you are viewing is older than three years, please ensure that you have the up-to-date version by contacting [email protected]. Please see Annex 2 for the version control.
Annex 1 - Privacy Schedules
Annex 2 – Version Control
| Version | Date | Changes | Sign off & next review |
| 1.0 | November 2023 | Notice created | Tom Deards, Legal & Governance Director, March 2025 |
