The Borthwick Institute for Archives is an archive repository and service. We are part of the University of York, which is the responsible ‘data controller’. The University was incorporated by royal charter, with a mandate to 'advance learning and knowledge by teaching and research, and to enable students to obtain the advantages of University education'. The Borthwick’s mission is to support and expand the University's cultural endeavour and contribute to human understanding through collecting archives and special collections, preserving them and making them widely available for research to all people, now and in the future.
We make our archive, art and rare book collections, our search rooms, finding aids, publications and resources available to the widest possible audience. To provide and improve our services we need to process some personal information from our visitors, users, donors, stakeholders and those who appear in the archival records we hold.
This privacy notice explains what you can expect us to do with your personal information when you make contact with us or use one of our services. It applies to information we collect about people who engage with us through the use of our services, sites and collections. Information on how the University processes the personal information of staff, students and visitors more generally can be found in its suite of privacy notices.
The Borthwick collects information about you in a variety of ways. These include:
Via our websites and online services, when you
When you use our services or participate in our events/activities:
When you visit the University campus:
From the archives and collections given and transferred to us:
We currently collect and process the following information.
The Borthwick Institute has a mandate to preserve the archives of the University and other historic records (including public records) permanently, and to make the records available for use. Information on our collecting mandates, how we manage archives and develop collections, is contained in our policies. The University’s Records Management policy covers the selection of University records for permanent preservation. We provide professional advice to University departments, donors and depositors as to whether documents are worthy of archival preservation (i.e. have lasting value for the research and understanding of history and the present, or for the protection of legitimate interests of citizens or for purposes of legislation, administration and jurisdiction).
We hold archives that span the period from the middle ages to the present day. We provide descriptions of our collections in our online catalogue. The archives include personal, business and family records, such as minutes, correspondence, parish registers, financial and medical records, files, photographs, video and sound recordings, and websites. They are in a range of analogue and digital formats.
We collect and preserve these archives so that we can provide access to them. While we seek to make them accessible to the widest audience possible, we must balance access against statutory and contractual obligations, public and private interests, and the preservation needs of the records.
Some of the more recent archives we hold contain information about living people: personal information that has been acquired by the organisations/individuals that have donated, deposited or transferred their records to the Borthwick Institute. Your information will be handled according to the safeguards built into the data protection legislation for archiving in the public interest. This means that we apply the same standards to handling this information, except that some of your rights have a limited application: see the section ‘What rights do you have in relation to your data?’ below.
We use a web archiving service, Archive-It, to collect, preserve and provide access to snapshot versions and content from public websites that complement our existing collecting areas and University research interests. The websites we harvest and preserve are selected on an individual basis in line with our collections policy. Please contact us if you have any questions or concerns about our archived web content or copyright.
People who use information about living people from the archives have a duty, under data protection legislation, not to use that information in a way which may cause distress or damage to those concerned or inform decisions relating to them. You should also be aware that, just because information is in the public domain, it does not necessarily make it lawful for you to share it or make it public. The documents that fall into this category are generally less than 100 years old. We will let you know when this restriction applies and will ask you to sign a Data Protection Researcher Undertaking. We may also seek confirmation of ethical approval for academic research projects involving special category data. Personal information and our archival records may also be subject to copyright restrictions.
To calculate when personal data that is closed for a person’s lifetime can be opened, we assume a lifespan of 100 years. This may result in information on people who are aged over 100 being made public. If this is the case, please contact the Borthwick Institute and we will remove your information from public access.
As the data controller, the University of York must have a legal basis for collecting and processing your personal data for all these activities under data protection legislation.
We collect, catalogue and make available our collections, and process the personal data held in them, because the processing is necessary for the performance of a task carried out in the public interest (or in the exercise of our official authority, such as under the Public Records Act 1958 or Parochial Registers and Records Measures of 1929 and 1978). More information on these official authorities is set out in our policies and archive repository description. As an accredited archive repository a key part of our public task is to secure and to make accessible the historical records in our custody and to deliver our services as widely as possible for the benefit of society.
Depending on the circumstances (e.g. for marketing), we may also process your personal information because you, or your legal representative, have given us your consent (which you can withdraw at any time).
Consent is not the only legal basis under which we can acquire and process your personal information. We do not require your consent to process your personal information if
We may share your data with third parties that process data on behalf of the University of York to support us in fulfilling our obligations and responsibilities to you and our public task (e.g. DeepStore, and software and system providers including but not limited to Archive-It (a service from the Internet Archive), Google and DocuSign).
We allow some third party publishers, (e.g. Ancestry, Wellcome and Findmypast), to digitise, or host digitised copies of, some of our archive records for online use. We and our publishers make every effort, taking into account the content and condition of the material, to avoid putting personal data online, especially any personal information that may cause damage or distress to living individuals.
The University of York will not share your information externally for any other purposes without your consent unless exceptional circumstances apply. Any such disclosures will be made in full accordance with the data protection legislation and only where necessary.
The University takes information security extremely seriously and has implemented appropriate technical and organisational measures to protect personal data and special category data. Access to information is restricted on a need-to-know basis and security arrangements are regularly reviewed to ensure their continued suitability. For further information see, https://www.york.ac.uk/it-services/security/.
In certain circumstances, it is necessary to transfer your Personal Data (including Special Category Data) outside the UK. In respect of such transfers, the University will comply with our obligations under UK GDPR and ensure an adequate level of protection for all transferred data.
We will retain your data in line with legal requirements or where there is a business need. Retention timeframes will be determined in line with the University’s Records Retention Schedule.
Personal data contained within the archival records in our collections will be retained permanently or for as long the relevant records are in our care.
Under the UK GDPR, you have a right of access to your data, a right to rectification, erasure (in certain circumstances), restriction, objection or portability (in certain circumstances). You also have a right to withdraw consent.
Please note that for personal data processed for archiving purposes in the public interest, in accordance with Article 89 (1) of the UK GDPR, the right of access to your data, right to rectification, erasure, restriction, objection or portability will not apply to the extent that applying the rights would prevent or seriously impair the achievement of those archiving purposes.
If you have any questions about this privacy notice or concerns about how your data is being processed, please contact us at firstname.lastname@example.org in the first instance.
If you are unhappy with the way in which the University has handled your personal data, you have a right to complain to the Information Commissioner’s Office. For information on reporting a concern to the Information Commissioner’s Office, see www.ico.org.uk/concerns.
We keep our privacy notice under regular review. This notice was last updated on 20th September 2022.