Privacy Policy

1. Who We Are

The Royal Yacht Britannia Archives (“we”, “us”, “our”) is operated by The Royal Yacht Britannia Trust. Our registered address is Ocean Drive, Leith, Edinburgh, EH6 6JJ. This privacy policy explains how we collect, use, and protect your personal information when you use our archive website.

2. Information We Collect

We collect information in the following ways:

Enquiry Submissions

When you submit an enquiry through our contact form, we collect your name, email address, telephone number (optional), a description of the item you wish to share, and any images you upload. This information is necessary to process your enquiry and respond to you.

Feedback

After submitting an enquiry, you may optionally provide feedback including a rating and comments about your experience. This helps us improve our service.

Staff Accounts

Authorised staff members have user accounts to manage the archive. Account information includes email addresses and authentication credentials, which are securely managed by our authentication provider.

3. How We Use Your Information

We use your personal information to:

• Process and respond to your enquiries about archive items
• Communicate with you about items you have submitted
• Improve our archive services based on feedback
• Manage staff access to the archive system

We do not use your personal information for marketing purposes, and we do not sell or share your data with third-party advertisers.

4. Legal Basis for Processing

Under the UK General Data Protection Regulation (UK GDPR), we process your personal data on the following bases:

• Consent — when you voluntarily submit an enquiry or feedback
• Legitimate interests — to manage and improve our archive services
• Contract — to manage staff access and employment-related obligations

5. Third-Party Services

We use the following third-party services to operate this website:

• Supabase — provides our database, user authentication, and file storage. Data is stored securely on Supabase’s infrastructure. Supabase Privacy Policy
• Resend — handles transactional emails such as authentication codes and password resets. Resend Privacy Policy
• Vercel — hosts our website. Vercel Privacy Policy

We do not use any analytics, advertising, or tracking services.

6. Data Retention

Enquiry data is retained for as long as necessary to process and resolve your enquiry, and for a reasonable period thereafter for record-keeping purposes. Staff account data is retained for the duration of employment or authorisation. You may request deletion of your data at any time by contacting us.

7. Your Rights

Under the UK GDPR, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Object to or restrict processing of your data
• Request a copy of your data in a portable format
• Withdraw consent at any time

To exercise any of these rights, please contact us at enquiries@tryb.co.uk.

8. Data Security

We take appropriate technical and organisational measures to protect your personal data. Authentication is secured with multi-factor authentication (MFA) for staff accounts, and all data is transmitted over encrypted connections (HTTPS). Access to the archive management system is restricted to authorised personnel only.

9. Cookies

For details on the cookies we use, please see our Cookie Policy.

10. Changes to This Policy

We may update this privacy policy from time to time. Any changes will be posted on this page with an updated revision date.

11. Contact Us

If you have any questions about this privacy policy or wish to exercise your data protection rights, please contact us:

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk.