Privacy Policy

Protecting the privacy of our users

Rockefeller Archive Center (RAC) is committed to protecting your privacy while enabling your access to information and engagement in our research community. We strive to make our archival collections and services as widely accessible as possible. To do this we need to acquire and use some personal information. This policy explains what information we collect from you and why, and how it is collected, used, and stored. It applies to your engagement with us through our services and activities on websites and during your visits to our physical premises.

Guided by legal requirements governing people in the EU/EEA and UK, this policy also provides a legal basis for our processing of your personal information. By data “processing,” we mean any operation performed on personal data including collection, organization, storage, alteration, retrieval, consultation, use, dissemination, restriction, or erasure. The Rockefeller Archive Center is located in the United States, and your data will be transferred to and processed in the United States.

This policy does not pertain to the acquisition or processing of personal information contained within our archival collections, for which we have a legitimate legal basis for archiving in the public interest.

What information do we collect and why?

We capture the minimum amount of personal information that we need for a particular purpose, and we keep it only as long as necessary to fulfill that purpose. Information will only be accessed by RAC staff with a legitimate business need to do so. We collect and process data that we obtain or that you provide to us in the following contexts:

Corresponding with access archivists

Emails or written correspondence related to archival reference services. This data can include:

Name
Contact details (address, email, phone)
Employer and employment title
Records of interactions including research topics and requested archival materials
Any other information that you volunteer

Legal basis: A legitimate interest to provide you with access services and support, and for our archives staff to refer to those records as a basis for providing access assistance to other users with similar questions.

Storage: Internal RAC systems for 8 years.

Paying for duplication services

Invoices and receipts for photocopying and digitization services. We use Paypal to securely process payments. This data can include:

Name
Payment record

Legal basis: To enable us to collect the correct payment for duplication services requested by you (a duplication services contract).

Storage: Internal RAC systems for 7 years.

Requesting archival records and duplication services

Registering for a user account and requesting archival records and duplication services, either remotely or on our premises. This data can include:

Name and username
Contact details (address, email, phone)
Institutional affiliation, academic department, or employer
User type category
Research topic and purpose category
Archival records requested and accessed
Dates and times of visits

Legal basis: Your consent at the time of data collection to use your anonymized data for statistical purposes to improve our services, to protect the security of the archival records in our custody, and to allow you to keep track of previous research activities, generate citations, and plan future visits.

Storage: Externally by a third-party service provider, Atlas Systems, Inc. Digital request records and account information are stored for 3 years and visit date/time data is stored for 2 years. You will be prompted to update your account annually. Paper documentation is not stored after the physical items are returned to archival storage.

Visiting and conducting research on our premises

Participating in a researcher orientation, working in our reading rooms, and using our facilities. This data can include:

Name and signature
CCTV footage

Legal basis: A legitimate interest to ensure that you understand the research and facility procedures associated with conducting research on our premises, and to protect the security of the archival records in our custody.

Storage: Orientation checklists with name and signature are stored for up to 1 year. CCTV footage is retained for up to 60 days, unless it is necessary to download specific footage segments for investigatory purposes.

Applying for or participating in our Research Stipend Program

Application materials and records related to the administration of the Program. This data can include:

Name
Contact details (address, email, phone)
Professional affiliations and employer
Research topic
Letters of reference

Legal basis: Consent given at the time of application.

Storage: Internal RAC systems and SurveyMonkey Apply servers. Applications that we do not fund are deleted upon declination. The name, email, institutional affiliation and Research Report from successful applicants are retained permanently; all other records are deleted once final reimbursement is made.

Using any of our websites

When you access any of our websites, online tools, and applications, we collect information through site logs, web forms, and third-party service tools. RE:source is hosted by Pagely and uses services that administer our newsletter and listserv, and manage site features and analytics, including MailChimp and JetPack. All of our public sites use Matomo to collect, analyze, and report visitor data.

This data can include:

Contact details (address, email, phone)
Log files, which contain data collected automatically including IP address, username, browser and operating system type and version, internet service provider, pages you visited, referring/exit pages, date/time stamp, and clickstream data.
Cookies, which are small data files placed on your device. Learn more in the following section about our use of cookies.

Legal basis: A legitimate interest to ensure system compatibility and performance, improve our understanding of our users’ needs, and protect the security of our systems. When signing up for our newsletter or listserv, you are giving consent for us to use and store your personal information to email you as requested. This Policy does not apply to any data collected by other organizations and sites that we link to from our sites and over which we have no control.

Storage: Log files are stored primarily on internal RAC systems for 1 year. Matomo raw user data is anonymized and stored by Matomo Cloud by InnoCraft in Germany for 180 days.

Matomo Analytics

All Rockefeller Archive Center websites use Matomo to gather anonymized, aggregated data about how people use our sites. The data collected in Matomo is only used for the measurement and evaluation of website use and performance and not for advertising or other purposes. We anonymize IP addresses in our analytics implementation and do not process any personal data; you can opt out of analytics tracking at any time:

When you access websites and use services online, sometimes those sites place a small data file on your device called a cookie. Some cookies are essential for a webpage to function properly or they improve its functioning, and others provide reporting information.

We use first-party session cookies on some web pages to improve the experience of using our sites. These are deleted when the browser is closed, and do not store any information that will personally identify you. We also include links to external sites like social media sharing that will place cookies on your device. We do not use advertising cookies.

You can block, manage, and delete cookies yourself at any time.

We do not sell your personal data to any other organizations. We will only share your personal data for the following purposes:

As necessary for our third-party service providers, as specified in this Policy.
As required by law or in a legal proceeding.
As otherwise authorized by you.

How can you contact us about your privacy?

You may contact us for additional information, to request access to or a copy of your personal data, or to request certain data be updated or removed. We will consider and respond to any requests in accordance with applicable laws. If you have consented to data processing, you can withdraw your consent at any time without affecting the lawfulness of any processing that was done based on your previous consent. Please note that if your data is contained within our archival collections, rather than collected by the RAC for the reasons stated in this policy, we will not alter the record.

Contact: archive@rockarch.org

Changes to this policy

We will review this policy periodically and may make changes in coordination with our Records Management Policy and Records Retention Schedule. If we make any significant changes in the way we treat your personal information, we will make this clear on our website.

Last updated November 1, 2024