Privacy Statement


Thackray Medical Museum is committed to protecting your personal information when you use any of our services. Whether you are a visitor, supporter, or volunteer we want to be transparent about the data we hold so that you feel confident about giving us your information.

This Privacy Policy gives you detailed information on when and why we collect your personal information, how we use it and how we keep it secure.  If we make changes to this policy, we will make sure this page is updated. We will never sell your personal data and will only share it with organisations we work with when it is necessary, and the privacy and security of your data is assured.

This policy will cover:

  • Who are ‘we’?
  • What personal data do we collect?
  • Why we collect your personal information and how we use it
  • How we handle your information
  • How we protect your data
  • Your choice
  • How to access your personal information (Subject Access)

Please see the separate section further down this page for information on Cookies.

Who are ‘we’?

In this policy ‘we’, ‘us’ and ‘our’ refer to Thackray Medical Museum. Our aim is to become the UK’s leading medical museum by delivering innovative and inspirational learning opportunities rooted in the heritage of medicine and healthcare.

Thackray Medical Museum is a charity, no.1016169. Company no.02772412.

Thackray Medical Museum also runs Thackray Medical Museum Trading Company Ltd, a wholly owned trading subsidiary.

If you have any questions relating to this policy they should be sent to Thackray Medical Museum, Beckett Street, Leeds, LS9 7LN or

What personal data do we collect?

We collect your personal information to allow us to carry out our business, provide the particular service you have requested and to keep you informed. We will only ever collect information that is relevant and proportionate, and we will not collect or store information unnecessarily. Examples of personal data we may collect include your name, postal address, email, telephone number or banking details.

When you interact with us we will collect personal data in connection with that specific activity. This may include buying admission or event tickets, registering as a museum Friend, booking an event, donations, volunteering, conducting research, employment etc.

The information we collect will vary according to the type of activity, but examples include:

  • Personal details – your name, email, address, telephone number etc.
  • Sensitive personal data – access requirements or pertinent medical information to make sure we offer you the best level of service and customer care when you are on-site.
  • Financial information – bank details and payment information such as credit or debit card and whether donations are Gift Aided.
  • If you enquire about our education programme or conferencing facilities, we will record information on where you work.
  • Email and newsletter records including emails sent, emails opened by you and links opened by you.
  • Information regarding any donations you have made to the museum.
  • Marketing preferences.
  • Publicly accessible profile information from the internet including Facebook, Instagram and Twitter.
  • CCTV images of you when you visit the museum.
  • Anonymised information: IP address, operating system, cookies.

Why we collect your personal information and how we use it

The information we hold on you will be used in several ways depending on your interaction with us.

To carry out our business and to provide a service, or carry out a contract with you:

  • To fulfil ticket, merchandise, donation and membership requests.
  • For administration purposes e.g. for Gift Aid.
  • To process payments.
  • To contact you with important information in advance of your booking or purchase, such as confirming your order, reminding you of an upcoming event you’ve booked or letting you know about changes that may affect your visit, including cancellations.
  • For internal record keeping – e.g. for employees and volunteers.
  • To thank you for donating to us and telling you how your money will be well spent.

Where we have your consent:

When appropriate, we will ask for your explicit consent before using your personal information, for example:

  • To send you updates via email about what’s on, offers and news or about supporting us.

You have the right to withdraw your consent at any time.

Where we have justifiable reason (including legal obligation and legitimate interest):

We collect and process your personal information for purposes that are in our legitimate organisational interests. We do this carefully, and in a way that we believe there is no overriding prejudice to you by using your personal information in this way.

  • To enable us to contact you about similar products and services (including events and activities) available at Thackray Medical Museum.
  • To enable us to email you a survey after visiting the museum or attending an event in order to evaluate its success and improve the museum’s programme and facilities.
  • To learn about your interests and preferences so that we can contact you with information that is relevant to you.
  • To help us target our marketing communications and adverts so that they’re more relevant to you.
  • Measure and understand how our audiences respond to a variety of marketing activity so we can ensure our activity is well targeted, relevant and effective.
  • For classifying our audience into groups or segments, using booking and publicly available information. These segments help us to understand our audience better and ensure we’re sending relevant messages to each group.
  • Storing CCTV images of people within the premises for monitoring and security purposes.
  • Undertake due diligence to detect and reduce fraud and credit risk.
  • To analyse the way in which our website is used and the content and links that you interact with, in order to improve our website services.
  • To take reasonable and appropriate steps to know who our donors are, particularly when significant sums are being donated.
  • To conduct research, including accessing publicly available information on prospective donors or corporate partners, including individuals and organisations, to ensure that accepting support is in our best legitimate interest.  Any information we do collect for this purpose will only consist of what is necessary for us to meet these requirements and will be processed in line with your rights.

You have the right to object to any processing of your personal data which has our legitimate interests as its legal basis if you believe your fundamental rights and freedoms outweigh our legitimate interests.  To object, please contact us at

How we handle your information

Thackray Medical Museum will never share, sell, rent or trade your personal information to any third parties for marketing purposes without your prior consent.

Some of our service providers may have access to your data in order to perform services on our behalf, for example during payment processing. They will not use your data for anything other than the clearly defined purpose relating to the service that they are providing.

  • We use our website to sign you up to our E-Newsletter database. Our website is provided by Maraid Design.
  • We share booking data with SHINE, our catering partner, to provide catering services.
  • We use Gateway Ticketing Systems UK to process our ticket sales (on-site and online) and to report on your order history, donation history and to show trends in sales patterns.
  • We use Microsoft Dynamics to report on sales, show trends, hold mailing lists, process memberships and keep in touch by email.
  • We use Mailchimp to send newsletters and emails.
  • We use Survey Monkey to send post visit surveys to evaluate our performance and facilities.
  • We use the National Fundraising Scheme (charity no 1149800) to process donations made via the website.
  • We use Sage and Brightpay for finance and payroll.
  • We may use other similar services provided by other parties, but which do not adversely affect your rights on the terms of this notice.

Thackray Medical Museum is not responsible for the privacy notices and practices of other websites even if accessed using links from and recommends that you check the notices of each website you visit and contact its owner or Data Protection Manager if you have any concerns or questions.

How we protect your data 

Thackray Medical Museum is committed to protecting the personal information you entrust to us. We adopt robust and appropriate technologies and policies, so the information we have about you is protected from unauthorised access and improper use.

As part of the services offered to you through Thackray Medical Museum website, the personal information you provide may be transferred to countries outside the European Economic Area (EEA). By way of example, this may happen if any of the computer servers used to host the website are located in a country outside of the EEA. If Thackray Medical Museum transfers your personal information outside of the EEA in this way, we will take steps to ensure that your privacy rights continue to be protected as outlined in this privacy notice.

Thackray Medical Museum may transfer your data to the USA to organisations such as Facebook, Google and Mail Chimp.

We will keep your information only for as long as is reasonably necessary for the purposes set out in this privacy notice and to fulfil our legal obligations and we will not keep more information than we need. The retention period will vary according to the purpose. Where there has been no interaction with you (e.g. a purchase or email opened), your record will be deleted after 24 months. For further information about how long we will keep your information, please contact us to see our full retention policy using the contact details outlined in this notice.

Your choice

It is your choice as to whether you want to receive information about our news, events and activities and the ways you can get involved. If you do not want us to use your personal information in these ways, please let us know.

You may opt-out of our marketing communications at any time by clicking the ‘unsubscribe’ link at the end of our marketing emails. You can also change any of your contact preferences at any time (including telling us that you don’t want us to contact you for marketing purposes by telephone, email or by post) by contacting us on 0113 244 4343 or

How to access your personal information (Subject Access)

You have the right to access the information that Thackray Medical Museum holds about you. You can ask us to:

  • Confirm that we are processing your personal data.
  • Give you a copy of that personal data.

You also have the right to rectify any inaccurate information we hold about you.

To request your information contact us in writing at Thackray Medical Museum, Beckett Street, Leeds, LS9 7LN, verbally on 0113 244 4343 or via email at

There is no fee for Subject Access Requests and we will respond within 28 days.

Notice updated on 09 August 2019