The NAS is dedicated to advancing education in nautical archaeology at all levels; to improving techniques in recording, preservation and reporting and to encouraging the participation of members of the public at all stages.

The NAS is a non-government organisation formed to further interest in our under-water cultural heritage. We are a registered charity based in the United Kingdom, but with strong links to partner organisations around the world. We aim to preserve our archaeological heritage in the marine environment, by acting as a focus for coastal and marine archaeology.

To do this the NAS needs to involve everyone- divers and non-divers, scientists, historians and anyone with an interest. Our underwater heritage is not renewable and is under constant threat from natural and human agencies.

The NAS is committed to protecting your privacy and our updated Privacy Notice sets out how we collect and use your personal data.

 

Who we are

The NAS is a UK based charity (Registered in England No. 1039270 English Registered Charity No: 262209 and Scotland No: SC040130) and a limited company (registered in England No: 1039270), but it also has strong links to other organisations around the world which work together collectively to promote the cause on a global scale.  Our registered office is at Fort Cumberland, Fort Cumberland Road, Portsmouth, PO4 9LD.

The NAS is the data controller of your personal data and is registered as an organisation with the Information Commissioner (ICO) under registration number Z8485324.

 

Questions and contact information

It is important that you read this Privacy Notice together with any other privacy notice or fair processing notice we may provide on specific occasions when we are collecting or processing personal data about you so that you are fully aware of how and why we are using your data. This Privacy Notice supplements the other notices and is not intended to override them.

If you have any questions about this Privacy Notice or how the NAS uses your personal data, please contact us by email at [email protected] or by writing to us at Nautical Archaeology Society, Fort Cumberland, Fort Cumberland Road, Portsmouth, PO4 9LD, marking the letter for the attention of Data Protection Responsible Person.

 

Information that we collect

Our website is not intended for children and we do not as a general rule collect data relating to children. The NAS does occasionally run youth engagement programmes for young people aged between eight and eighteen years of age and will accept young people on course and events when accompanied by their parent or guardian, in which case we will collect the full names and ages of the attendees, and this is done with the prior written consent of the attendees’ parent or guardian.

When you register with the NAS or any subsidiary project websites, and each time you place an order through our website, the NAS will require some personal data from you - including your name, billing address, delivery address, email address and telephone number and product selections. This information allows the NAS to fulfil your order and notify you of the status of the order. Details of payment card numbers and expiry dates etc go through a secure server operated by the NAS’ Payment Service Provider, Pay Pal, and to which the NAS does not have direct access. Details of payment card numbers and expiry dates which are received by telephone are directly entered into the payment machine and not stored.

The NAS collects personal data relating to our clients and potential clients in order to carry out our business activities. This includes name, organisation name, email address, business address, phone numbers and any other data that we need in order to carry our contractual obligations. This relates to anyone with whom we have a business relationship, either through our commercial activities or our activities as a charity. This data is not shared with any third parties and is only used for the purposes that the individual would expect.

The NAS collects personal data relating to those that engage with our various Research and Education programmes and charitable objectives. This information is only stored when permission has been given by the individual for the purposes of contacting them regarding events, partnerships, training, news and fundraising.

 

How we collect information from you

Direct from you: where you create an account on our website or subsidiary project websites; purchase our publications; request marketing to be sent to you; sign up to our training programmes; provide your details in order to create business opportunities (including by giving us your business card, contacting us by email, post or telephone on a speculative basis, or regarding an existing contract or project); or perform contracts,

 

Automated technologies: as you interact with our website, we may automatically collect personal data about your equipment, browsing actions and patterns. We collect this personal data by using cookies, and other similar technologies. We do not use these cookies to identify individuals as they are used for statistical purposes only. You can restrict or block the cookies used by our website through your browser settings but this will impact your user experience. Please see our cookies policy for further details.

 

Third parties or publicly available sources: we may receive personal data about you from various third parties and public sources as set out below including analytics providers such as Google (based outside the European Economic Area); publicly available sources such as Companies House and the Charities Commission.

 

Purpose and lawful basis for processing your personal data

We process your personal data in order to provide the services that you have requested (and if you do not agree to this processing, we will not be able to perform our contract with you), or where we have a legitimate interest of furthering our charitable objectives, including through fundraising, and your individual interests and fundamental rights do not override our legitimate interest.

The NAS will always seek individuals’ prior consent before sending direct marketing to an individual’s email address, and when individuals sign up for any volunteering or engagement project opportunities.

The exception to this is the NAS "Weekly Discoveries" email newsletter, which we consider to be in the legitimate interest of the Society to share with our members and will be emailed weekly to all current members, unless they specifically request not to receive the weekly email. Our justification for this is that the weekly newsletter contains information considered to be of interest to members of the NAS, does not contain any direct marketing material and is a published benefit of being a member of the NAS.

Where we process your personal data based on your consent, you have the right to withdraw your consent at any time, and you have the right to opt-out of receiving direct marketing communications from us at any time.

 

Sharing your personal data

Except as specified in this section, we do not pass on your details to any third party (including any local authority) unless you give us permission to do so.

We may share your personal data:

• In the case of projects that are being managed jointly, your personal data will be shared with the project partner(s) to the extent necessary for the management and administration of the project.
• With external service providers, to the extent required for the performance of the services, for example our cloud storage provider, membership portal provider and publisher of the journal.

We require all third parties to respect the security of your personal data. We do not transfer your personal data outside of the European Economic Area.

 

How long do we keep your personal data?

The personal data collected by the NAS is evaluated periodically to determine whether it is current and still needs to be held, and the applicable legal requirements. We store your personal data in accordance with our retention policy.

 

Data security

We have put in place appropriate technical and operational security measures to prevent unauthorised access to your personal data. We keep our security measures under regular review.

 

Individual rights

You have the right to:

Request access to your personal data (also called a "data subject access request"). This will allow you to receive a copy of the personal data we hold about you.

Request correction of the personal data that we hold about you. This allows you to have any incomplete or inaccurate data we hold about you corrected.

Request erasure of your personal data. This allows you to ask us to delete or remove personal data where there is no valid reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.

Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information.

Request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in the following scenarios: (a) if you want us to establish the data's accuracy; (b) where our use of the data is unlawful but you do not want us to erase it; (c) where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or (d) you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.

Request the transfer of your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.

Withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.

Lodge a complaint with a supervisory authority, in this case the Information Commissioner’s Office (ICO). You have the right to complain to the ICO and their website is at www.ico.org.uk, but we would prefer if you raised any issues with us first.

 

Last updated: 22 May 2018