Privacy Notice for Customers

In accordance with the General Data Protection Regulation (GDPR), we have implemented this privacy notice to inform you, our customers, of the types of data we process about you. We also include within this notice the reasons for processing your data, the lawful basis that permits us to process it, how long we keep your data for and your rights regarding your data.

This notice applies to current and former customers.

Who we are

The data controller is The Richard Ormonde Shuttleworth Remembrance Trust (Registered with the Charity Commission No. 307534).

The Richard Ormonde Shuttleworth Remembrance Trust is responsible for The Shuttleworth Collection, The Swiss Garden, and The House. Our registered address is Shuttleworth, Old Warden, Bedfordshire, SG18 9EP.

If you have any questions about this Privacy Policy, you can get in contact by writing to:

Chief Data Officer: Andrew Rutt, 01767 627979

How we collect information about you

There are several ways we may collect information about you. These include:

  • When you book tickets with us via our website, email or by telephone
  • When you sign up for our email contact list
  • If you report a problem or complaint (via our website, email, telephone, or social media)
  • When you get in contact about any of our services (via our website, email, telephone, or social media)
  • When you contact us about other enquiries such as making a donation, seeking press accreditation, undertaking filming or photography, or research and archives enquiries.

We may also collect information about you if you consent to the use of cookies when using our website. Telephone calls, except voice mails, are not recorded. We use CCTV on site.

What information we collect about you

This can include any of the following:

  • name
  • address,
  • phone number,
  • email address,
  • company name,
  • company address,
  • payment details where relevant,
  • IP address, geographical location of where you accessed our website, information about how you use/interact with our website, information from cookies (if you have consented to their use) and information about your computer or other electronic device (tablet and browser type).

More information on our use of cookies can be found further down this page.

Security of your information

Shuttleworth respects your data and has taken appropriate technical and organisational measures to ensure we have mitigated against such risks as loss or unauthorised access, destruction, use, modification or disclosure of data.

Collection of Special Category data

We do not collect special category data as a matter of course. However, individuals may on occasion supply health-related information in relation to delivery of services by Shuttleworth. For example, visitors may share such information should they require blue badge parking or additional assistance with accessing our site. This information may be shared internally in order to meet out visitor needs. The information is retained only as long as is necessary and is processed solely for this purpose.

Job applicants

We hold information about job applicants to enable us to contact you.

The personal information we hold will have been provided by you and will be your name, address, contact information, current and previous job details.

The information is only disclosed to those key staff involved in the recruitment process for the job you have applied for.

We will retain information on all applicants for a maximum period of 6 months, in line with recommended minimum retention periods; unless you have specifically requested we hold your details for future job opportunities.

Any data received through pre-employment checks that results in a withdrawal of job offer will be securely destroyed.

We do not use your personal data for any automated decision making or profiling.

Your rights concerning your personal data are:

  • You can ask to see the personal data we hold about you and we will show you, free of charge.
  • We will update the personal data to correct errors when you tell us about them.
  • We will supply you with an electronic copy of the personal data we hold about you if you ask us to.
  • We will stop processing your personal data if you tell us to.
  • We will delete your personal data if you ask us to. The law says we must not contact you again if you ask us not to. For this reason, we may need to keep the paper trail confirming deletion to make sure this happens.

How we use your information and the legal basis for this

Your information is used to deliver our services and contact you, process your purchases, and to improve the website experience for our users.

When you purchase from us, we may collect the following information: name, date of birth, phone number, email address, address, billing address, company name (if applicable), VAT number (if applicable). If you don’t provide this information, you won’t be able to purchase from us or enter into a contract with us. In these instances, we process your personal data because it is necessary for the performance of a contract with you, or in order to take steps at your request to enter into a contract.

When you send us an enquiry or purchase from us, you can opt in to receive marketing communications in relation to our products and services by ticking the relevant box. We will then send you the relevant marketing communications until such time that you remove your consent. In these instances, processing is performed on the basis of your consent. One of the features of purchasing online tickets is access to our e-newsletter containing information on our events, offer, news and job/volunteer roles.

In addition to this, we’ll also contact you with important operational information regarding events/services that you have booked with us (i.e. event cancelation). In these instances, we process your personal data because it is necessary for the performance of a contract with you.

Who we share your data with

We will only share your data with third parties for the purposes of delivering our services, fulfilling any contracts we enter with you, where required by law or to enforce our legal rights.

Third party communications

Shuttleworth will not disclose your details to third parties for the purpose of receiving communications from those third parties, including relevant business information, unless you specifically request this type of communication.

Service providers

Only when necessary to deliver our services and run our business, we share your information with various providers who will act as data processors. These include:

  • Telephone and email providers
  • Payment processing providers
  • IT service & hosting providers
  • Print/mailing/fulfilment companies

Mailing, print and fulfilment companies

Shuttleworth will only disclose your information to print and fulfilment companies who are conducting business on Shuttleworth’s behalf and only for an agreed purpose, such as marketing mailings. Once the purpose for which data is transferred is complete, it is deleted.

Payment information

Our online ticket system is through Roman Cart.


Shuttleworth may share your details with third parties for the purposes of conducting research on our behalf, only when you have consented to your data being processed in this way. You can opt out of being included in surveys by unsubscribing at any time.

Sharing your information for legal reasons

Shuttleworth will share your information when required to do so in order to comply with a common law or statutory obligation. For example, this may include information surrounding criminal acts or threats to public security.

How long we retain your data

We will keep hold of your data for no longer than necessary. The length of time we retain it will depend on any legal obligations we have (such as tax recording purposes), the nature of any contracts we have in place with you, the existence of your consent or our legitimate interests as a business.


When you purchase from us, for example events and daily admissions, we retain that information for a period of six years following the end of the financial year during which you purchased from us. It is our legal obligation to keep these records for tax purposes.


Unless you provide consent for future contact during your enquiry, we will keep your information for as long is required to respond and complete your enquiry, and for a further 12 months, before deleting your information.


Donation information will be retained in order to verify Shuttleworth’s ownership of artefacts and/or donated income as part of our register of donors.

Profiling and automated decision making

Details on your interactions with Shuttleworth may be used to review the relevance and quality of the products and services we offer. Shuttleworth does not undertake any automated profiling or automated decision-making processes.

Your rights

Subject to certain limitations, you have the right to:

  • Request a copy of the information we hold about you and be told about its use.
  • Request that Shuttleworth rectifies or deletes your information, or restricts processing if you have concerns over its accuracy, deletion or fair and lawful use.
  • Object to the processing of your personal data, based on your particular situation, where this processing is based on the legitimate interests of Shuttleworth, where it involves direct marketing, or where it is completed for research or statistical purposes.
  • Withdraw consent to the use of your information. All of our non-operational communications contain an unsubscribe link and you can contact our Chief Data Officer at any time.
  • Receive your personal data in commonly used format (i.e. Word or text file) to transfer to another data controller. However, in some circumstances we may be unable to provide you with some or all of your personal data, for example, if it compromises the confidentiality of a third party.

Concerns & Complaints

If you have concerns or questions over the collection, storage or processing of your data, you are encouraged in the first instance to contact a member of staff to discuss and resolve any issues.

Alternatively, you can write directly to the Chief Data Officer at:

You also have the right to lodge a complaint with a supervisory authority. In the UK, this is the Information Commissioner’s Office (ICO). Contact details for the ICO are available here.



Cookies are small text files that are placed on your computer by websites that you visit. They are widely used in order to make websites work, or work more efficiently, as well as to provide information to the owners of the site.

This website uses the following cookies:


  • Google Analytics – Features for recording browsing behaviour on the website
  • Facebook – Features for sharing via Facebook. Does not set a cookie by itself, but if one is present it will read it.
  • YouTube – Features for sharing videos via YouTube, and remembering what videos you’ve seen.
  • RomanCart – Used when the customer clicks on the ‘remember my details for next time’ option on the checkout.
  • RMNCTCKC – used to tell if cookies are enabled
  • CTAB – used to tell if a cart has been abandoned.
  • Targeting or advertising cookies – these cookies are used to deliver ads relevant to you.  They also limit the number of times that you see an ad and help us measure the effectiveness of our marketing campaigns.

Most web browsers allow some control of most cookies through the browser settings. To find out more about cookies, including how to see what cookies have been set and how to manage and delete them, visit