Sheffield Beer Museum
Last updated: 19 October 2026
Sheffield Beer Museum CIC is the data controller for the personal information described in this notice, which means we decide what is collected and what happens to it, and we are responsible for it. We are a community interest company registered in England and Wales, company number 16801963, with our registered office at The Circle, 33 Rockingham Lane, Sheffield, England, S1 4FW.
You can reach us by email at enquiries@sheffieldbeermuseum.co.uk, by telephone on 07400 062116, or by post at The Circle, 33 Rockingham Lane, Sheffield, England, S1 4FW. We are not required to appoint a data protection officer and have not appointed one. Data protection is handled by our board of directors.
This notice explains what we do with your personal information when you join our mailing list, take part in our public consultation survey, buy something from our online shop, browse our website, or get in touch with us.
When you sign up we collect your email address, your first name if you give it, and the date and the page you signed up from, which we keep as our record that you asked to hear from us. We use it to send news about the museum, invitations to events and consultation sessions, volunteering opportunities, appeals for donations of objects, money or time, and news about what is in our shop.
We rely on your consent, which you give by entering your address and confirming that you want to hear from us. If you have bought something from the shop we may also email you about similar products without asking again, which the law allows where we told you so at the time and gave you the chance to say no. Either way you can stop the emails whenever you like, using the unsubscribe link at the foot of every email or by writing to us, and doing so does not make anything we did beforehand unlawful.
We keep your details until you unsubscribe or ask us to stop. We also review the list every two years and remove addresses that have not opened or clicked anything in that time. When someone unsubscribes we keep their email address on a suppression list so that we do not add them back by mistake. We keep that record for as long as we run a mailing list and we use it for nothing else.
The survey asks what you think of the idea of a beer and brewing museum in Sheffield, what you would want it to include, and what your connection is to the city's pubs and breweries. We also ask for the first part of your postcode, such as S3 or S11, so that we can see which parts of the city and region we have reached. We do not ask for your full address, and you can answer the whole survey without telling us who you are. You only give us your name and email address if you want a reply or want to join the mailing list.
We rely on legitimate interests. Our interest is in finding out whether there is public support for the museum, in using what people tell us to shape what we build, and in evidencing that support in funding applications and in our application for Museum Accreditation. We have weighed that against the effect on you. The survey asks for very little that identifies anyone, taking part is voluntary, you can answer anonymously, and we do not market to you off the back of it unless you separately ask us to. On that basis we are satisfied that our interest does not override your rights. You can object at any time, and you can ask us for the assessment we made.
We delete responses that identify an individual within 24 months of the consultation closing. We keep the anonymised results, which cannot be traced back to anyone, for as long as the museum exists, and we use them in reports, funding bids and our accreditation application.
The last section of the survey asks about age, ethnic group, religion or belief, disability, sex, gender identity and sexual orientation. We ask because we want to know whether we are reaching a fair cross-section of people in Sheffield, and because funders and the Museum Accreditation scheme expect us to have looked. If we are missing whole groups of people, we would rather find out and do something about it.
This section is entirely optional. Every question can be skipped and every question has a "prefer not to say" option, and if you skip all of it the rest of your response still counts.
We rely on your consent under Article 6(1)(a) of the UK GDPR. Most of what this section asks about is special category data, which carries extra protection, and for that we rely on your explicit consent under Article 9(2)(a). You give it by ticking the box at the start of the section, which explains what we will do with your answers. You can withdraw your consent by writing to us, although once answers have been combined into anonymous totals we can no longer pick yours out in order to remove them. If that is the case we will tell you.
We report the answers only as totals, such as the proportion of respondents who told us they have a disability, and we never publish or share them in a form that identifies anyone. Where a survey is answered anonymously they are not connected to a name at all. We delete the individual answers within 12 months of the consultation closing and keep only the totals.
We sell merchandise and museum goods through an online shop, which runs on Shopify. When you place an order we collect your name, email address, telephone number, billing and delivery addresses, what you ordered, what you paid and when, along with any account details if you create an account and any notes you add to your order.
We never see or hold your full card number. When you pay, your card details go straight to our payment provider, who is regulated to handle them, and all we get back is confirmation that the payment succeeded, the type of card and the last four digits. That is enough for us to match a payment to an order and to process a refund.
For taking and fulfilling your order we rely on performance of a contract with you, under Article 6(1)(b) of the UK GDPR, because without this information we cannot sell you anything or send it to you. For keeping records of the sale we rely on our legal obligations under Article 6(1)(c), as HMRC requires us to keep records of transactions. For preventing fraud and keeping the shop secure we rely on our legitimate interests in protecting the business and our customers.
We keep order and payment records for six years from the end of the financial year in which the order was placed, which reflects HMRC's requirements and the time limit for bringing a claim about a contract. If you have an account we keep it until you ask us to close it, and we close accounts that have not been used for three years.
If you email us, telephone us or use a contact form, we keep your message and your contact details so that we can reply and keep a record of what was said. We rely on our legitimate interests in running the organisation properly and dealing with the people who contact us. We keep correspondence for three years from our last exchange with you, except where it concerns an object offered or given to the collection, which we keep permanently as part of that object's record, because a museum has to be able to show where everything in its collection came from.
Our website and shop are hosted by Shopify, which keeps standard technical records of visits, including IP addresses, the device and browser used and the pages looked at. These are used to make the site work, to keep it secure and to spot problems. Shopify keeps them for a limited period for those purposes and we do not use them for anything else.
We use only the cookies that are needed to make the site work, such as those that remember what is in your basket or keep you logged in. We do not use analytics cookies, advertising cookies or tracking of any other kind, so there is nothing here you need to agree to or turn off.
Within the museum, access is limited to the directors and volunteers who need it for the job in hand, and only for that job.
Outside the museum, your information is handled by:
Shopify, which hosts our website and shop and processes orders, payments and site data on our instructions under a written contract. Shopify also uses some information about how people use its merchants' stores for its own purposes, such as fraud prevention and improving its platform. Where it does that, Shopify is responsible for that use rather than us, and its own privacy policy at privacy.shopify.com explains it.
Google, whose Forms, Sheets and Drive products we use to collect survey responses and hold our records. Google acts on our instructions under a written contract and is not permitted to use the information for its own purposes.
Zoho, which hosts our email accounts and therefore holds any correspondence you have with us, on the same basis.
beehiiv, which holds our mailing list and sends our newsletter, again on our instructions under a written contract.
Our payment provider, so that your payment can be taken, and our delivery companies, who receive your name, address and, where needed, a contact number so that your order can reach you.
Our professional advisers, such as our accountant, where they need it in order to do their work for us.
Funders, assessors and regulators, but only ever aggregated results, never anything that identifies you.
Anyone we are required by law to tell, for example in response to a court order.
We do not sell your information and we do not share it with other organisations for their own marketing.
Shopify, Google, Zoho and beehiiv are global companies, and some of your information may be accessed or stored outside the UK, including in the United States, Canada and India, by them or by their own suppliers.
Where that happens the transfer is covered by safeguards approved for use under UK law. These are the UK International Data Transfer Addendum to the European Commission's standard contractual clauses, which is included in our contracts with Shopify, Google, Zoho and beehiiv, and, for transfers to the United States, the UK Extension to the EU-US Data Privacy Framework, under which Google LLC and Shopify are certified. Ask us for a copy of the safeguards that apply and we will send them to you.
Access is limited to the people who need it and protected by individual accounts and two-factor authentication, and we do not keep survey responses, mailing list data or customer records on personal devices or removable drives. No system can be made completely secure and information sent over the internet is never entirely risk free, so please do not send us confidential or sensitive information by email.
If there is a breach of security that is likely to put people at risk, we report it to the Information Commissioner's Office within 72 hours of becoming aware of it, and we tell the people affected where the law requires us to.
Our shop is not intended for children and we do not knowingly collect information about anyone under 18 through it. Where children take part in our consultation or in museum activities we ask a parent or guardian first, and we collect only what we need for that activity. If you are a parent or guardian and you believe your child has given us information, tell us and we will delete it.
Our website links to other sites, including those of breweries, pubs, funders and partner organisations. We are not responsible for how those sites handle your information, so read their privacy notices before giving them anything.
Under UK data protection law you have the right to be told what we do with your information, which is what this notice is for, and the right to get a copy of what we hold about you. You can have it corrected if it is wrong or incomplete, and have it deleted in certain circumstances, including where we rely on your consent or on legitimate interests. You can ask us to restrict what we do with it while a question about it is being resolved, and you can object to our use of it where we rely on legitimate interests, which covers the survey and correspondence.
You can tell us to stop using your information for direct marketing at any time. That right is absolute and we will always act on it. Where we rely on your consent you can withdraw it at any time, which covers the mailing list and the equality monitoring questions. Where we rely on your consent or on a contract with you and hold the information electronically, you can also ask for a copy in a portable format.
Most of these rights are qualified rather than absolute, which means there are situations in which we can decline, and if we do we will explain why. We may need to check who you are before acting on a request. We do not make decisions about anyone by automated means and we do not profile people.
To use any of these rights, email us at enquiries@sheffieldbeermuseum.co.uk. We will reply within one month, or tell you within that month if your request is complex enough that we need up to two months more. There is no charge.
If you are unhappy with how we have handled your information, please tell us first at enquiries@sheffieldbeermuseum.co.uk. We will acknowledge your complaint within 30 days, look into it, and let you know the outcome.
You can also complain to the Information Commissioner's Office, which regulates data protection in the UK. You do not have to come to us first, although raising it with us usually gets things sorted out more quickly. The ICO can be reached at Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, on 0303 123 1113, or at ico.org.uk/make-a-complaint.
If we change what we do with personal information we will update this notice and change the date at the top. Where the change is significant and we hold your email address, we will tell you by email.