Volunteers Privacy Notice

Last updated: 18 June 2026

1. Who we are

Wimbledon Windmill Museum is a charitable organisation based at Windmill Road, Wimbledon Common, London, SW19 5NR.

We are the data controller responsible for the personal information we collect about our volunteers.

If you have any questions about this notice or how we use your data, you can contact us at:

Email: chairman@wimbledonwindmill.org.uk

Wimbledon Windmill Museum

Windmill Road

Wimbledon Common

London SW19 5NR

2. What personal data we collect

We may collect the following categories of personal data about volunteers:

Basic information

Name, address, email address, telephone number
Volunteer management information
Availability, rota information, and attendance records
Skills, experience, qualifications, and interests
Training and supervision records
Safeguarding and compliance information
References
DBS check results (where required)
Relevant health information (where necessary for safe volunteering)
Emergency and welfare information
Emergency contact details
Relevant medical or accessibility information you choose to provide
Images
Photographs or video recordings (where applicable)

3. How we collect your data

We collect personal information:

Directly from you (e.g. application forms, emails, conversations)
From referees you provide
From checks required for your role (e.g. DBS checks, where relevant)

4. Why we use your personal data

We use your personal data to:

Manage and administer your volunteer role
Communicate with you about activities, rotas, and events
Ensure the safe and effective running of the museum
Provide training and support
Meet safeguarding requirements
Maintain records for insurance and legal purposes

5. Lawful basis for processing

We must have a lawful basis for using your data. We rely on:

We rely on legitimate interests to run and manage our organisation effectively. We have balanced this against your rights and consider this use to be reasonable and proportionate.

6. Special category data

Some information we process (e.g. health data, DBS checks) is considered special category data.

We only process this where:

It is necessary for safeguarding or legal compliance, or
You have given explicit consent, where appropriate.

7. Sharing your data

We may share your personal data with:

Trustees and authorised volunteers within the organisation
Service providers (e.g. email systems, volunteer management tools)
Regulatory or safeguarding authorities where required by law

We do not sell personal data.

8. International transfers

Some of our service providers (e.g. email or cloud storage providers) may store data outside the UK.

Where this occurs, we ensure appropriate safeguards are in place, such as:

UK adequacy regulations, or
Standard contractual clauses.

9. How long we keep your data

We retain your personal data as follows:

Volunteer records: during your time with us and for up to 6 years afterwards (for insurance and legal purposes)
Safeguarding/DBS records: in line with safeguarding guidance and legal requirements
Photographs (with consent): until consent is withdrawn or no longer needed.

If no longer needed, your data will be securely deleted or destroyed.

10. Your data protection rights

You have the following rights under UK data protection law:

Access – request a copy of your data
Rectification – correct inaccurate data
Erasure – request deletion
Restriction – limit how we use your data
Objection – object to processing based on legitimate interests
Withdraw consent – at any time (where we rely on consent)

To exercise your rights, contact us using the details above.

11. Complaints

If you are unhappy with how we handle your data, please contact us first so we can try to resolve the issue.

You also have the right to complain to the Information Commissioner’s Office (ICO):

Website: https://ico.org.uk
Telephone: 0303 123 1113

12. Changes to this privacy notice

We may update this notice from time to time. The latest version will always be available on request.