Cumbria Archives
Preserving and providing the historical records of Cumbria

Privacy Notice

Privacy Notice

Who we are
Cumbria Archives is a service of Cumberland Council and Westmorland and Furness Council.  We are hosted by Cumberland Council as our parent authority.  We collect and care for historical records including records created by both councils and their predecessors in the course of their business, records held on behalf of central government, and records given to or purchased by the authority or deposited with the authority on long term loan.  We act as the custodian of records spanning over 900 years of history relating to Cumbria and the historic counties within its boundaries prior to 1974 (Cumberland, Westmorland, Lancashire and Yorkshire). We operate four Archive Centres at Barrow, Carlisle, Kendal and Whitehaven where records can be accessed by public users.  We provide a full list of our operating policies on our website.

Cumbria Archives will process your personal data in accordance with all applicable laws, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018). 

What is personal data?
The term “Personal Data” means any information relating to you that identifies you, or through which you can be identified, directly or indirectly. In particular, by reference to an identifier such as a name, an identification number, location data, or an online identifier or to one or more factors specific to you physical, physiological, genetic, mental, economic, cultural or social identity.

Reasons we can collect and use your personal data
Cumbria Archives collects personal information as part of its public task.  Our core functions are carried out within a complex legal framework including the Local Government (Records) Act 1962, the Local Government Act 1972, the Public Records Acts 1958 and 1967, the Parochial Registers and Records Measure 1978 and the Manorial Documents Rules 1959.

Information available for re-use
The Public Task statements above set out the functions carried out by Cumbria Archives and what information is available for re-use under the Re-Use of Public Sector Information Regulations 2015.  You can see, copy and re-use information that is produced by the Service (for example catalogues, indexes, policies, procedures) free of charge provided it is not subject to data protection legislation or a third-party agreement.

You can also see archives and publications held by us free of charge during our opening hours. You can make a copy of most of these items for personal use.  Any re-use of such copies for publication or other commercial re-use requires further permission. Restrictions include copyright and data protection legislation and are outlined in our copyright declaration form which is available with further details about our copying services and charges on our website.

The personal information we collect
In the course of registering as an archive user, completing customer enquiries and providing services to users, we collect the following personal information when you provide it to us:

  • Titles
  • Names
  • Addresses
  • Signatures
  • Telephone numbers
  • Email addresses
  • Photographs
  • Partial credit card details (first 6 digits, last 4 digits name and expiry date), where you have paid online for our services

How we use your personal information
We will only use your personal data for the purpose we collected it and in accordance with the law. We use your personal information for the following purposes:

  • Registering you as an archive user.  We are part of the Archives Card scheme, operated by the Archives and Records Association.  We may collect some of your data on their behalf.  All data is held by the Association and a separate privacy notice for the scheme can be found on their website.
  • Contacting you to respond to an enquiry.
  • Requiring you to abide by copyright permissions.
  • Agreeing terms of deposit/donation of records with you.
  • Agreeing terms of volunteering with us.
  • Retaining partial credit card details by Cumberland Council, though no further action is taken with these. A separate general privacy notice is available on the Cumberland Council website. Payments are processed by the GOV UK payments scheme as processor and more information about how they process your data is available on their website.

Our legal bases for processing your data
The UK and EU GDPR, (our global standard of compliance) requires that a Controller must have a legal basis for processing personal data. More details are provided in the Schedule of Processing but, in most instances, our legal bases for processing your personal information are:

  1. Your consent. We will obtain you consent by [Insert method for obtaining consent] and you are able to withdraw your consent at any time. You can do this by contacting [Insert contact details].
  2. We have a contractual obligation.
  3. We have a legal obligation.
  4. We have a vital interest.
  5. We need it to perform a public task.
  6. We have a legitimate interest.

How long your personal data will be kept
We will only keep your Personal Data for as long as is necessary to fulfil the purposes we collected it for, which may include satisfying any legal, accounting, or reporting requirements. The retention period depends on the type of Personal Data and the reason we are processing it. 

When calculating the appropriate retention period for your data, we consider the nature and sensitivity of the data, the purposes for which we are processing the data, and any applicable statutory retention periods. Using these criteria, we regularly review the Personal Data which we hold and the purposes for which it is held and processed.

When we determine that Personal Data can no longer be retained (or where we must comply you request us to delete your data in accordance with your right to do so) we ensure that this data is securely deleted or destroyed.

We will hold your personal information for the following periods:

  • For the period of time you are an archive user
  • For the period of time you are a volunteer
  • For the year of your enquiry plus six years
  • For the year of your payment plus six years
  • Permanently when relating to legal agreements with us, such as relating to deposit or donation of records, copyright use, licensing/publication agreements, and agreements for privileged access to closed records for academic purposes

Security of your personal data
In order to protect your personal data, we put in place appropriate organisational and technical security measures. These measures include ensuring our internal IT systems are suitably secure and implementing procedures to deal with any suspected data breach.

In the unlikely event of a data breach, we will take steps to mitigate any loss or destruction of data and, if required, will notify you and any applicable authority of such a breach.

Although we use appropriate security measures once we have received your personal data, you will appreciate that the transmission of data over the internet (including by email) is never completely secure. We endeavour to protect personal data, but we cannot guarantee the security of data transmitted to or by us.

Transferring your personal data outside of the EEA
To provide our services, we may need to share your Personal Data with third parties and suppliers outside the European Economic Area (the “EEA”). If we do this, we will ensure your personal data receives the same protection as if it were being processed inside the EEA. For example, our contracts with our suppliers stipulate the standards they must follow to process Personal Data. 

We currently implement the following safeguards to protect your personal data:

  • Encrypting data when in transit.
  • Implementing appropriate safeguards such as Standard Contractual Clauses (SCCs), as approved by the European Commission, International Data Transfer Agreements, the UK Addendum to the EU-US Data Privacy Framework 

OR 

We do not transfer any personal data outside of the EEA.

People in our archival collections
Some of the more recent archives we hold (including paper, sound, video or digital records) contain information about living people.  This information is handled according to the safeguards in data protection legislation for archiving in the public interest.

People who use information about living people from archives held by us have a duty, under data protection legislation, not to use that information in a way which may cause distress or damage to them. You should also be aware that, just because information is in the public domain, it does not necessarily make it lawful for you to make it public.  For further information, please refer to our Public Access Policy, Searchroom Rules and Researcher Declaration on our About Us webpage.

We may allow third party publishers to digitise some of our records for online use. We and our publishers will make every effort, taking into account the content and condition of the material, to avoid putting personal information online that may cause damage or distress to living individuals. As data processors, our publishers must comply with data protection legislation; in particular, they have a duty to assist you in exercising your rights over your personal information.

We, or our publishers, may use automated profiling to calculate when personal information that is closed for a person’s lifetime can be made open. To do this we assume a lifespan of 100 years. This may result in information on people who are aged over 100 being made public. If this is the case, please contact us and we will remove your information from public access.

Reclosure and takedown statement
Occasionally there are circumstances in which we may take down material from our websites or from third party social media platforms which we use. Information published on our websites should be considered to be in the public domain and will be removed from that website only in exceptional circumstances, at the discretion of Cumbria Archives. The information will be regarded as having been removed temporarily and may be restored at a date decided by Cumbria Archives. Material may be taken down temporarily on receipt of a request from a member of the public or organisation. The case will then be considered by the Cumbria Archives Management Team with advice, where necessary, from the Information Governance Teams from Cumberland Council and/or Westmorland and Furness Council. Material will be taken down in the following circumstances:

  • Material made available in good faith is now considered to be subject to an exemption under the Freedom of Information (FOI) Act 2000 or the Environmental Information Regulations (EIR) 2004.
  • Where the material discloses personal information about someone who is still alive and continued online access would be unlawful or unfair to them under data protection legislation or would breach their or their family’s right to a private and family life under the Human Rights Act 1998.
  • Making the material available online might invoke an infringement of copyright.
  • The material is defamatory or obscene.
  • The material was released in error and removal is required to rectify a mistake.

Should the member of public or organisation disagree with the Management Team's decision not to take down information, then they have the right to appeal to the relevant Information Governance Team.

To contact us about material on our websites, use our feedback form.

Your rights
You have rights under the data protection legislation and, subject to certain legal exemptions, we must comply when you inform us that you wish to exercise these rights. There is no charge, unless your requests are manifestly unfounded or excessive. In such circumstances, we may make a reasonable charge or decline to act on your request. Before we action your request, we may ask you for proof of your identity. Once in receipt of this, we will process the request without undue delay and within one calendar month. In order to exercise your rights please contact dataprotection@cumberland.gov.uk. 

You can contact us if you wish to complain about how we collect, store and use your personal data. It is our goal to provide the best possible remedy with regard to your complaints. 

However, if you are not satisfied with our answer, you can also contact the relevant competent supervisory authority. In the UK, the relevant supervisory authority is the ICO, contact details of which can be found below.

Your rights in connection with personal information are set out below:

Subject Access Request - You have a right to receive a copy of all the Personal Data we hold about you.

Rectification - If any of the Personal Data we hold about you is incomplete or inaccurate, you have a right to have it corrected.

Erasure - This is also known as the “right to be forgotten”. You have a right to ask us to delete your Personal Data where there is no good reason for us continuing to process it. However, certain criteria apply and if we have a legitimate reason to continue processing your personal data, we will not be legally required to delete it.

Objection - You have a right to object where we are relying on legitimate interests as our legal basis for processing your Personal Data but, in certain circumstances we may be able to continue with the processing. For example, if we have compelling legitimate grounds which override your interests, rights and freedoms or your personal information is needed for the establishment, exercise or defence of legal claims. However, you have an absolute right to object to us processing your Personal Data for direct marketing purposes. 

Restriction - You have a right to ask us to restrict the processing of your Personal Data in certain circumstances. For example, you may require us to suspend processing information about you whilst checks are made to ensure it is accurate. 

Portability - You have the right to ask us to transfer any Personal Data you have provided to us to another party, subject to certain criteria being satisfied. We will provide this Personal Data in a structured, commonly used and machine-readable format.

Right to withdraw consent - If you have given us your consent for the processing of your Personal Data, you can withdraw this at any time. Please note, the withdrawal has no effect on the legality of the data processing carried out in the past on the basis of your consent. To exercise your right to withdraw consent contact us at [Insert contact details].

Right to complain - If you are unhappy with the way in which your personal information has been or is being processed, you have the right to make a complaint about it to the Information Commissioner’s Office (ICO). They can be contacted at:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

www.ico.org.uk 

Your obligations
If any of your personal data changes whilst you are a user of our services, it is important that you update the information within your account to ensure that the data we hold about you is accurate and up to date. 

Changes to this Privacy Notice
We reserve the right to update this Privacy Notice from time to time. Updates to this Privacy Notice will be published on our website. To ensure you are aware of when we make changes to this Privacy Notice, we will amend the revision date.  Changes apply as soon as they are published on our website. We therefore recommend that you visit this page regularly to find out about any updates that may have been made.

V2. April 2025, © Cumbria Archives

The above information is also available as a downloadable PDF at Cumbria Archives Privacy Notice_20250414 v2.1.pdf (PDF, 148.92KB).