Privacy Notice

The National Portrait Gallery is committed to protecting your personal information. This Privacy Notice sets out which information is collected about you by the Gallery, how we use it and the choices and controls you have.

We will never sell, rent or exchange your details with any other organisation outside the National Portrait Gallery without your prior consent.

This Privacy Notice has been prepared to be as comprehensive as possible, but it does not include an exhaustive list of every aspect of our collection and use of personal information. However, we would be happy to provide any further information or explanation about our practices. If you have any general queries or concerns about this policy, please contact our Data Protection Officer at [email protected].

Changes to this Privacy Notice

From time to time the Gallery will change this privacy notice. You may therefore wish to check this page each time you submit personal information to the Gallery. The latest privacy notice will always appear on this page.

This Privacy Notice was last updated on 20 June 2023.

Who we are

This Privacy Notice applies to the National Portrait Gallery, London (NPG). The Gallery was founded in 1856 to collect and display portraits of people who have contributed to British history and culture. Today the Gallery’s Collection is among the largest and most prestigious collections of portraits in the world. The Gallery is a Non-Departmental Public Body supported by the Department for Culture, Media and Sport (DCMS) and is an exempt charity under the Charities Act 2011. You can find out more about the functions the Gallery by reading our statement of public task.

The National Portrait Gallery Company Limited (Company Number 06015724) is a wholly owned subsidiary of the Gallery, which was set up to generate income to help the Gallery meet its overall aims and objectives.

Both the National Portrait Gallery and the National Portrait Gallery Company Limited’s address is 2 St Martin’s Place, London, WC2H 0HE.

Under this notice, ‘we’, ‘NPG’ and ‘the Gallery’ refers to both the National Portrait Gallery and the National Portrait Gallery Company Limited.

Data Protection

The Gallery will only use your personal information in accordance with this Notice, its Data Protection Policy setting out the principles, rules and guidelines its staff need to follow when processing your personal data, and relevant data protection laws including the UK General Data Protection Regulation, Data Protection Act 2018 and any reiteration of relevant legislations.

The National Portrait Gallery and the National Portrait Gallery Company Limited may each be data controllers of your personal data. They each have different roles, but some activities they undertake inevitably overlap and personal data may be shared internally for certain purposes. Information may be shared between them to facilitate, support and integrate their respective activities.

The National Portrait Gallery’s Data Protection registration number is Z5637141.

The National Portrait Gallery Company Limited’s Data Protection registration number is Z984498X.

Our lawful bases for processing your data

Under data protection law, we need a lawful basis to collect and use your personal data. The law allows for six ways to process personal data. All of these are relevant to the types of processing that we carry out. This includes information that is processed on the basis of:

  1. a person’s consent (for example, if you consent to receive our e-newsletter)
  2. a contractual relationship (for example, to provide you with goods or services that you have purchased from us, such as a ticket or Membership)
  3. complying with a legal obligation (for example to process a Gift Aid declaration, or carrying out due diligence on large donations)
  4. the Gallery’s public functions as defined by DCMS (for example, in maintaining and providing access to our collections)
  5. protecting an individual’s vital interests (for example, in matters of life and death)
  6. the legitimate interests of the Gallery, you as an individual, or wider benefits to society (please see below for more information)

Personal data may be legally collected and used if it is necessary for a legitimate interest of the organisation using the data, if its use is fair, and if it does not adversely impact the rights and freedoms of the individual concerned.

When we use your personal information, we will always consider if it is fair and balanced to do so and if it is within your reasonable expectations. We will balance your rights and our legitimate interests to ensure that we use your personal information responsibly and in ways that are not unduly intrusive or unfair.

If you would like more information on our use of legitimate interests, or to change our use of your personal data in this manner, please get in touch with us by contacting our Data Protection Officer at [email protected].

For more information about the way the Gallery processes special category and criminal offence data, please see our Appropriate Policy Document.

Your rights

We want to ensure you remain in control of your personal data and that you understand your legal rights, which are:

  • the right to know whether we hold your personal data and, if we do so, to be sent a copy of the personal data that we hold about you(known as a ‘Subject Access Request’/SAR) within one month;
  • the right to have inaccurate or incomplete personal data updated or amended;
  • the right to have your personal data erased (though this will not apply where it is necessary for us to continue to use the data for a lawful or legitimate reason or to fulfil our obligations under our public task);
  • and the right to object to your personal data being used for marketing or profiling.

Please note your rights over your personal data are dependent on which legal basis is being relied upon by the Gallery. There are some exceptions to the rights above and, although we will always try to respond to any instructions you give us about our handling of your personal information, there may be situations where we are unable to meet your requirements in full.

If you would like further information on your rights or wish to exercise them, please contact our Data Protection Officer (details below).

It is important that the information we hold about you is accurate, therefore please let us know of any changes to the personal information you give to us. Please also get in touch if you wish to know what personal information we hold about you or how we process your information. This is your right of access and is known as a Subject Access Request (SAR). To submit a SAR you can contact us by email at [email protected], or write to us at Data Protection Officer, National Portrait Gallery, St Martin’s Place, London, WC2H 0HE. Please note you will be asked to provide proof of identification.

Disclosure of your information

We occasionally use third party data processors for the purpose of distributing communication materials (e.g. a mailing house). Where we do this, we will always undertake due diligence checking and enter into a suitable data processing agreement with the third party organisation to ensure your personal information will be processed in accordance with the UK General Data Protection Regulation and Data Protection Act 2018 and any reiteration of relevant legislations.

We will disclose your personal information to third parties if we are under a duty to disclose or share your personal data in order to comply with any legal obligation; or in order to enforce or apply our Terms and Conditions of Use and other agreements; or to protect the rights, property or safety of the Gallery, our customers or others. This includes exchanging information with other companies and organisations for the purposes of fraud protection.

In some cases, we work with external suppliers to provide certain services. All data is transferred securely and all external suppliers have signed data sharing and confidentiality agreements with the Gallery.

Storage and Retention of your information

The Gallery’s preference is that data we collect from you is stored in the UK/EU (European Union). Where your data is transferred and stored outside the UK/EU we will take all steps reasonably necessary to ensure that any data processor we use provides an adequate level of protection for your data. The transmission of information via the Internet, unfortunately, is not completely secure, and any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to help prevent unauthorised access.

Once your personal information is no longer required we will delete it from our records in a secure manner. Not all records can be deleted immediately; The Gallery has statutory, legal, business continuity and administrative requirements to hold on to certain records for specified periods. More information about the Gallery’s Records Management Policy can be found in the Archives and records management policy.

Statistical information

The Gallery will keep records of a statistical nature where personal data will be anonymised, in order to improve our provided services.

Questions and complaints

Should you have a question or complaint about how we have used your personal data, you can contact us directly by contacting our Data Protection Officer in the first instance via email at [email protected], or by writing to Data Protection Officer, National Portrait Gallery, St Martin’s Place, London, WC2H 0HE.

If you are still not happy, or for independent advice about data protection, privacy and data sharing, you can contact: The Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Telephone: 0303 123 1113 or 01625 545 745. Or visit the Information Commissioner's Office website.

Some of the Gallery’s onsite services are operated by third parties, and are governed by their own specific terms. Our Privacy Notice does not govern these third parties. We make all reasonable efforts to ensure any third parties the Gallery uses will protect your information in line with UK data protection and privacy laws. However, we will not accept responsibility for third party applications or for any loss or damage arising from your use of them.

Processing transactions onsite

We use the following third parties to process transactions onsite:

  • WorldPay for Print on Demand orders and mobile PDQ machines
  • Windcave, our payment solution provider
  • Experian for address verification: Experian Privacy Policy

Photographs in the Gallery and at events

The Gallery reserves the right to take photographs in public and gallery spaces and at events. Individuals should notify staff if they do not wish to be photographed. All reasonable efforts will be made to gain approval (usually via a consent form) from the subject of any image of an identifiable person which the Gallery publishes in print or online. Parents/Guardians will be asked to sign approval forms for children under 13 years old.

CCTV and body-worn cameras

The Gallery uses CCTV and body worn cameras to monitor our buildings and the area around them as part of our public task to protect our Collections, visitors and staff, and for the prevention and detection of crime. In the event of a security incident, footage (which may include images of you) will be shared with the police and/or local authorities where it is our legal obligation and is appropriate to do so.

The body worn cameras used by Security staff do not record automatically, and will only be activated in the event of an incident. Where ever possible or practical, security officers must inform the subject that they are being recorded. All Security staff that use this equipment receive specialised training.

Images of you may be used to provide supporting evidence in internal investigations. The Gallery does not use CCTV to monitor staff performance. The Gallery’s CCTV systems are only operated by holders of valid Public Space Surveillance licenses issued by the Security Industry Authority (SIA). The SIA is regulated by the UK Home Office.

Images may also be reviewed for official purposes when investigating an incident and the National Portrait Gallery complies with the Information Commissioner’s (ICO) and the Surveillance Camera Commissioner’s CCTV Code of Practice.

Images are stored for 30 days. Exceptions apply in cases where images are required to be saved for longer periods to support active investigations or, following an incident, for a limited period to satisfy legal statutes of limitations.

The CCTV Code of Practice documents that the Gallery comply with can be found here:

Information Commissioner’s Office

Surveillance Camera Commissioner

Ticket Purchase

We collect information about you when you:

  • Purchase a ticket
  • Book an event
  • Create a user account or log into the ticketing section of our website.

We will use the personal data you provide for the purposes of processing your ticket purchase or booking, providing you with assistance through our customer service team, keeping you informed about your booking and any changes, and asking for feedback about your experience. We use your information for these purposes to fulfil our contractual obligations in providing these services to you.

When you make a purchase, we will share your personal information with the following third parties:

  • Windcave, our payment solution provider
  • Her Majesty Revenue and Customs (HMRC) to process Gift Aid on your purchase if you ask us to claim it
  • Tessitura, the Gallery’s CRM system
  • PCI Pal, if you make the purchase over the phone
  • Soprano and PS Financials, to process financial data
  • Other organisations in order to detect and reduce card fraud and credit risk.

We will keep details of your purchase and financial information for seven years in accordance with our legal obligations under UK tax law.

Improving the experience and services offered to visitors

The Gallery has legitimate interests in learning more about its visitors, how they interact with the Collections and why they come to the Gallery; as well as generally improving the experience for and services offered to visitors. For these reasons we will use your personal data to:

  • Learn about your interests and preferences so that we are able to personalise your experience and contact you, with your consent, about programme or product information that is relevant to you.
  • Use booking and publicly available information to classify our audience into groups or segments. These segments help us to understand our audience better and ensure we are sending relevant messages to each group.
  • Analyse and continually improve the services we offer.
  • Measure and understand how our audiences respond to a variety of marketing activity so we can ensure our activity is well targeted, relevant and effective.

Attending a private event (including online)

We collect information about you when you RSVP to a private event hosted by the National Portrait Gallery, either at the Gallery or elsewhere, including the names and contact details of any guests that you nominate. We will use the personal data you provide for the purposes of administering your RSVP, keeping you updated about the event, meeting your individual needs to attend, and managing the event. We use your information for these purposes to fulfil our contractual obligations in providing these services to you, as part of our public task to make our Collection available under the Museums and Galleries Act 1992, and on the basis of substantial public interest when you share special category data with us to allow us to meet your accessibility and dietary needs.

Please note, if you attend a private event held at the Gallery that is hosted by a third-party, the organiser of the event will collect your information and will only provide the Gallery with a list of guest names. This is for security purposes and to allow you access to the event. We use your information for these purposes to fulfil our contractual obligations to the event organiser, and as part of our public task to ensure the safety and security of guests and staff.

Occasionally, we will use contact details that we hold or that are available in the public domain to invite individuals who have a specific interest or involvement in the Gallery to attend special events and to deepen our connection with individuals and organisations who might have an interest in the Gallery’s work. We use your information for these purposes as part of our public task to make the Collection available to members of the public and in our legitimate interests to promote the Gallery, its exhibitions and its services.

We may share your information with zkipster, the Gallery’s guest list management provider, to manage the guest list and to check you in when you arrive at an event - zkipster privacy policy. Guest lists are deleted from zkipster the day after the event.

Your contact details may be shared with Eventbrite to manage the RSVP process.

For online events, the Gallery may host these events using Microsoft Teams or Zoom. Online events hosted by a third party may use other platforms.

We will share any dietary requirements you tell us about with the caterer of an event, to safeguard your health and safety and to ensure your dietary needs are met. For a list of the Gallery’s approved caterers please see our approved suppliers list. This information is collected on the basis of your explicit consent.

If the event you attend includes an auction, you will be asked to register your name and email address to take part. We will share this information with Givergy, the Gallery’s auction service provider, for the purposes of registering and managing your bids and pledges - Givergy Privacy Notice. Payments of winning bids and pledges will be processed directly by the Gallery.

Eat and drink

Please note the Portrait Restaurant and Audrey Green are run by third parties, and when you make a booking or sign up to their newsletters, your personal data is being held and used by these third parties.

The Portrait Restaurant is run by The Corrigan Collection, and information about their use of your data can be found on their website: https://www.corrigancollection.com/.

Audrey Green is run by Daisy Green, and information about their use of your data can be found on their website: https://www.daisygreenfood.com/privacy-policy.

Onsite WiFi

We collect your MAC address when you connect to our WiFi service, which is used to provide you with a WiFi connection. This information is processed on the basis of the contract we have with you. If you sign up to receive our newsletter through the WiFi portal, we will also collect your name and email address. This is processed on the basis of your consent. We use Purple WiFi to provide our WiFi service, and this data is retained for six months.

Visitor to view works not on display

We collect information about you when you:

  • Book an appointment to view works or items not on display
  • Book an appointment to visit the Heinz Archive & Library
  • Complete an application form to view items not on display
  • Complete a Visitor Agreement form to register as a user of the Heinz Archive & Library or view an object not on display
  • Make a research enquiry or correspond with staff.

Visitors to view Primary Collection works not on display

When you make a request to view works in the National Portrait Gallery’s Primary Collection which are currently not on display, we will use the personal data you provide (name and contact details) for the purposes of processing your booking, keeping you informed about your appointment and any changes, and to allow a visitor pass to be created for the day of your visit. We use your information for these purposes as part of our public tasks to make our collections available to researchers and for the public’s enjoyment, and to ensure the safety and security of visitors and staff.

For each and every visit to our stores (a facility shared with Tate), you will be required to complete an application form with your personal information. This is to allow you supervised access to the stores and the material it holds, to record your agreement to abide by the conditions the form sets out, and to contact you after your visit in the event of any issues or concerns. These purposes fall within our public task to make our collections available to researchers and for the public’s enjoyment.

The personal information you provide as a visitor to the stores will only be shared with:

  • Tate Security, to administer your visit to the Gallery’s external store (if applicable) in Southwark
  • The referees you nominate in your application, should further checks be required (you should get permission from your referees to provide their details to the Gallery for this purpose)

If you visited the Heinz Archive & Library and/or the Gallery’s other stores based in Orange Street, your visitor pass and associated information will be deleted on the date your access expires (usually at the end of the day of your visit). If you visited the Gallery’s external store in Southwark as part of your enquiry, this building is managed by Tate and so your details will be held in line with Tate’s retention schedule - Tate Privacy Policy.

We will keep your booking information and a copy of your application form for five years in accordance with our retention schedules and legal compliance. Overall numbers of visits to see works on display may be collected for statistical and analytical purposes.

Visitors to view Reference Collection Photographs

When you make a request to view photographs from the National Portrait Gallery’s Reference Collection, you will be treated as a visitor to the Heinz Archive & Library. We will use the personal data you provide (name and contact details) for the purposes of processing your booking, keeping you informed about your appointment and any changes, and to allow a visitor pass to be created for the day of your visit.

We use your information for these purposes as part of our public tasks to make our collections available to researchers and for the public’s enjoyment, and to ensure the safety and security of visitors and staff.

Visitors to the Heinz Archive and Library

When you make a request to visit the Heinz Archive & Library, we will use the personal data you provide (name and contact details) for the purposes of processing your booking, keeping you informed about your appointment and any changes, and to allow a visitor pass to be created for the day of your visit. We use your information for these purposes as part of our public task to make our resources available to researchers, and in the vital interest of safety and security.

When you first visit the Heinz Archive & Library, you will be required to complete a Visitor Agreement form with your personal information. This is to allow you access to the Heinz Archive & Library and the material it holds, to record your agreement to abide by the conditions the forms sets out, and to contact you after your visit in the event of any issues or concerns. These purposes fall within our public task to make our resources available to researchers, and our legal obligations in relation to copyright and data protection.

The personal information you provide as a visitor to the Heinz Archive & Library will not be shared with external third parties or any other organisations.

Your visitor pass and associated information will be deleted on the date your access expires (usually at the end of the day of your visit). We will keep your booking information for two years and a copy of your Visitor Agreement form for six years for the above purposes, in accordance with our retention schedules and legal compliance.

Contacting the Gallery

If you are a Member, Patron, or have another existing relationship with the Gallery, any general contact you have with the Gallery will be held alongside your other records.

Making a Research Enquiry

When you make a research enquiry or correspond with staff regarding British portraits, the history of the Gallery or items in the Gallery’s Collections, we will use the personal data you provide (name and contact details) for the purposes of recording your enquiry and responding to your request. We use your information for these purposes as part of our public task to make our resources available to researchers, and it will not be shared with external third parties or any other organisations.

Enquiries and correspondence regarding items not in the Gallery’s Collections or which are of no ongoing research value will be deleted three years after the last meaningful correspondence on that subject. Enquiries and correspondence regarding items in the Gallery’s Collections, or that the Gallery deems to be important for historical or research purposes will be kept for permanent preservation in the Gallery Records. This is for archiving in the public interest purposes, and any sensitive information will be withheld from the public.

Submitting information via “Tell Us More”

We collect information about you when you submit information about one of the portraits in our Collection via the “Tell Us More” option on the Gallery’s website. We collect your name and contact details to provide you with an update on the review of the information you have submitted. We process your personal data as part of our public task to improve our Collection and the related resources.

When you submit this information, you can choose to have your comments published alongside your name. Publishing this information is done on the basis of your consent.

Following moderation, any comments that are approved become part of the Gallery’s Collection and will be retained permanently, alongside your name. Contact details will be retained for two years.

Complaints, Feedback, and Other Enquiries

We collect information about you when you make an enquiry, provide feedback or send us an e-mail or letter. We will use the personal data you provide (name and contact details) in order to respond to you and take any necessary action. We use your information for these purposes as part of our public task to promote the public’s enjoyment and understanding of portraiture, and to maintain a collection of portraits of people who have contributed to British history and culture.

The personal information you provide for these purposes will not be shared with external third parties or any other organisations.

If your complaint or feedback relates to or includes financial information, we will retain your information for seven years to meet our legal obligations under UK tax law. If you make a formal complaint, we will retain the information for two years from the last meaningful contact, in case you wish to escalate your complaint. For any other feedback, we will keep your information for up to three months after your last meaningful contact with the Gallery, and then your enquiry or feedback will be anonymised.

Freedom of Information Act enquiries

When you make a Freedom of Information Act enquiry, make any formal complaint on the handling of your enquiry (for example requesting an internal review) or correspond with staff with respect to any request you have submitted, we will use the personal data you provide (name and contact details) for the purposes of recording your enquiry and responding to your request.

We use your information for these purposes as it is within our public task to comply with the requirements of the Freedom of Information Act (2000).

Personal data you supply will not be shared with external third parties or any other organisations during the initial stages of your enquiry. During the course of any Information Commissioner investigations and higher (tribunal) the Gallery will be required to share personal data in order to fully assist the regulator with the fulfilment of their functions.

Your personal data will be kept for a period of 3 years after the last meaningful contact with respect to your enquiry; after such time your personal data will be deleted from our systems. Anonymised information relevant to your enquiry maybe kept permanently for statistical reasons only.

Please also note that any information you supply to the Gallery (personal or otherwise) will thereby be held by the Gallery and thus subject to the terms of the Freedom of Information Act. It is highly likely that personal data supplied to the Gallery as part of a Freedom of Information request (or in deed for any other reason) would be exempt from disclosure.

Exercising Your Data Subject Rights (including Making a Subject Access Request)

In order for the Gallery to process any data subject rights requests, including the Right to Erasure, Right of Access, and the Right to Restrict Processing, we will need to collect information about you. When you submit a request or correspond with staff with respect to any request you have submitted, we will use the personal data you provide (name, contact details, and proof of identity and any further information you choose to provide) for the purposes of recording your request, locating any relevant data, and responding to your request. We use your information for these purposes as part of our public task to comply with the Data Protection legislation.

We will not share the personal information you provide when you submit a request with external third parties or any other organisations, unless it is required to identify your records. In response to any Information Commissioner investigations, the Gallery may be required to share personal data to fully assist the regulator with the fulfilment of their functions.

Where collected, proof of your identity will be retained by the Gallery for one year, after which it will be destroyed. The Gallery retains case files for individual SARs for three years from receipt, after which they will be destroyed. Anonymised information relevant to your SAR maybe kept permanently for statistical reasons only.

Archiving personal data for research purposes

The Gallery will select relevant documents/communications obtained through public research enquiries and correspondence with staff about the Gallery’s Collections for permanent preservation and retain records indefinitely for research purposes and archiving in the public interest. Any sensitive information will be withheld from the public.

Website user

Cookies

Cookies are small data files that a website can transfer to an individual’s computer hard drive for record keeping. Cookies can make websites easier to use by storing information about your preferences on a particular website. The information may remain on your computer after the Internet session finishes and you leave the website but you can delete them using some browsers, manually or using system utilities. Most internet browsers are pre-set to accept cookies.

If you wish to restrict or block the cookies, which are set by NPG websites, or any other website, you can do this through your browser settings. The Help function within your browser should tell you how. For more information on cookies and their uses, visit the cookies page on the Information Commissioner’s Office website.

Most elements of the Gallery’s website will still function if you disable cookies in your web browser settings.

In general, we use cookies in the following ways:

  • Temporary, ‘session’ cookies to help you navigate through our website and to enhance your user experience. These cookies are temporary and disappear when you close your browser.
  • Analytics cookies to recognise and count visits to our website, how visitors use our website and how they get to the website. This information is used to help improve the website and services provided. Information collected in this way does not personally identify you.
  • Third Party cookies may be set by social media tools or other external applications if you are a user of those services. For example, when you visit a page with content embedded from Facebook, SoundCloud, Twitter, YouTube, Google Maps or Flickr, you may be presented with cookies from these websites. The Gallery does not control the dissemination of these cookies. You should check the third-party websites for more information about these.

Full list of Cookies in use

Cookies used on npg.org.uk

Cookies used on my.npg.org.uk

Cookies used on npgshop.org.uk

Cookies used on npgimages.com

Cookies used on librarycatalogue.npg.org.uk

Cookies used on britishportraits.org.uk

Other websites, web applications and third-party service providers

The Gallery uses some social media sites and other third party platforms to share content and encourage engagement with our Collection. To access this content, customers may need to enter into an agreement with these third parties directly. Please read the terms and conditions when signing up to any external services; the Gallery may not be responsible for the personal data that is shared with these third parties.

The Gallery may include links to content on third party websites or services, and we accept no responsibility or liability for the content on these sites.

We use the following third parties to process transactions online:

Google Analytics

We use Google Analytics to collect information about how our visitors use and navigate the Gallery’s website. We use this information to report to funders such as the Department for Digital, Culture, Media and Sport (DCMS), and to analyse usage of the website so that we can continually work to improve the site and your experience of it. The cookies collect information such as the number of visitors to the site, which pages they visited and whereabouts they came to the site from. This information is anonymous and cannot be used to identify you personally.

Personalised advertising

If you browse the Gallery’s website, you may receive personalised banner advertisements whilst browsing other reputable websites or social media platforms. The Gallery has a legitimate interest in marketing our activities to those with an existing interest in the Gallery to help raise income. We are committed to providing you with information on products and offers which are relevant to you. The banner advertisements will relate to exhibition pages, events or products which have been viewed whilst browsing the Gallery’s website on your computer or other device. This service is provided by the Gallery via reputable third-party specialist companies like Sizmek and Quantcast, through the use of cookies placed on your computer or other device. These companies may choose to target you based on your IP host address and non-Personally Identifiable Information (Non-PII). This includes but is not limited to the date and time of activity online, the pages viewed, browser type, referring URL, Internet Service Provider and operating system. These companies do not collect Personally Identifiable Information (PII) such as name, address, phone number, email address or credit card information.

You can visit these individual companies and read their privacy policies for more information on how to opt out. The Sizmek privacy policy and Quantcast privacy policy are available online.

You may also opt out of receiving further personalised advertisements in the future by clicking on the bottom right hand corner of any advertisement you receive and following the instructions.

User Accounts

We collect information about you when you create a user account and log in to the following website services:

  • Ticket purchase/event booking
  • Making a donation
  • Membership or Patronage
  • Online shop
  • Applying for a job
  • Licensing an image
  • Subscribing to the e-newsletter

We will keep your information for the necessary period for the above purposes in accordance with our retention schedules and legal compliance. Further information can be found in other sections of this Privacy Notice. We will keep details of your purchase and financial information for seven years in accordance with our legal obligations under UK tax law.

Surveys

We occasionally run surveys to improve our website and services. Cookies are used to allow the form or pop-up survey to be hidden on your return visits. This is to prevent you from being shown the survey again unnecessarily. Cookies are also used to record the overall number of answers to the survey questions and to link these to web statistics. They do not store your personal data.

Ticket Purchase

We collect information about you when you purchase a ticket, book an event, create a user account or log into the ticketing section of our website. Please see the Visitors to the Gallery section of this Privacy Notice for further information.

Links to non-National Portrait Gallery websites

The Gallery accepts no responsibility or liability for content on third-party websites. Users clicking on links to external sites should check the Terms and Conditions and Privacy Policy of the site they are visiting.

Marketing

E-newsletter subscriber

We collect information about you when you opt in to receive the Gallery e-newsletter/s and join our mailing list. With your consent we will use the personal data you provide (name and email address) to send you the relevant e-newsletters and email updates. You can withdraw your consent at any time by using the unsubscribe link at the bottom of all e-communications.

When you sign up to the Gallery’s mailing list you can tell us your preferences for what you want to hear about. You can update your preferences at any time by logging into your account. If you opted in to receive the Gallery e-newsletter/s when you signed into our onsite public Wifi, please email [email protected] to register your preferences.

Your information will be stored on the Gallery’s CRM system, and we will share your personal information with third parties who we use to send out our e-communications. These are:

We will keep your personal information to send you the Gallery e-newsletters and email updates until you unsubscribe or withdraw your consent for this.

Marketing communications

You have the right to ask us not to process your personal data for direct marketing purposes (e.g. providing you with information about the Gallery’s programme of exhibitions and events, shop products or fundraising initiatives). We will inform you before collecting your data if we intend to use your personal information for such purposes. You can stop us using your data in this way at any time by exercising your right to object to processing and contacting us at [email protected].

Online advertising

We use Google and META advertising to market the Gallery's services, exhibitions, and products to customers who may be interested. This will be based on any interactions you have with the Gallery on these platforms, your geographical location, and any other relevant interests that are identified. Your interests are collected by these third parties as part of your direct relationship with them, and you can control what adverts you receive via the settings associated with these accounts. The Gallery may exclude certain customer groups from advertising campaigns or may refine the audience by sharing information, but this will not be in a format that allows individuals to be identified. Depending on the nature of the campaign, some information may be collected by the advertisers on our behalf, and this will be deleted by the advertiser at the end of the campaign.

Supporter of the Gallery (including Members & Patrons)

The Gallery is an exempt charity under the Charities Act 2011 and must self-generate 60% of its income. This includes fundraising, and we rely on the generosity of our supporters and sponsors to continue our work.

We use Tessitura, a customer relationship management (CRM) system, to support our fundraising activities and to deliver an excellent service to our Members, Donors and supporters. This means that we keep the personal data you provide us with, so that we are able to see the history and relevant details of your relationship with the Gallery.

We collect information about you when you:

  • Sign up to become a Member or Patron
  • Make a donation to the Gallery and/or ask us to claim Gift Aid
  • Leave the Gallery a gift in your will
  • Fundraise to support the Gallery.

Members

When you sign up to become a Member, we will use the personal data you provide (name, contact details, payment details) for the purposes of: administering your membership; processing your membership subscription payment; providing you with your membership benefits; responding to enquiries you raise; sending you updates about events, benefits, services, special offers and fundraising activities; providing you with access to events; contacting you when your membership expires or is due to expire; and contacting you if there is an issue with your membership or payment. We use your information for these purposes to meet our contractual obligations to you, and in our legitimate interests to keep you updated about activities at the Gallery and your membership.

For full details please refer to the Terms and Conditions of Membership.

To help us to provide the best level of service and offers to our Members, every two years we will invite you to participate in the Members Survey online. You can let us know how you would prefer to be contacted, ask us to update your personal information, or object to receiving these communications at any time through your Member Account online or by contacting the Membership team at [email protected].

If you purchase a Membership for somebody else as a gift, we will use your personal data to set up and service the Membership. If you are the recipient of a Gift Membership, we will let you know who gave us your information and make you aware of this Privacy Notice and how to manage your communication preferences in your Welcome Letter.

When you visit the Gallery, we will scan your Membership card to check your entitlement to free entry, to understand how and when our members visit, and to help us send you more relevant communications. In our legitimate interests to understand our members and provide improved communications and benefits to them, we will carry out demographic profiling and we may use your personal data for marketing, statistical, and analytical purposes.

We will share your information with third parties who we have commissioned to act on our behalf in order to fulfil your membership. These include:

If you ask us to claim Gift Aid on your membership, we will share your name and address with Her Majesty Revenue and Customs (HMRC) as a legal requirement in order to process the Gift Aid claim.

We will keep your information for the necessary period to process and administer your Membership, and we will keep records of financial transactions and Gift Aid claims for seven years in line with UK tax law.

Patrons, Life Patrons, Director’s Circle, Corporate Members

When you sign up to become a Patron, a Life Patron, or a member of the Director’s Circle we will use the personal data you provide (name, contact details, payment details) for the purposes of administering your membership, processing your membership subscription payment, providing you with your membership benefits, sending you updates about benefits, services, and fundraising activities, inviting you to special events, and contacting you when your membership expires or is due to expire and if there is an issue with your membership or payment. We use your information for these purposes to meet our contractual obligations to you, on the basis of your consent, and in our legitimate interests to keep you updated about activities at the Gallery and your membership.

If you are affiliated with the Gallery through a corporate membership, we will use your work-based contact details and corporate accounts information to process payment and administer your corporate membership. We use your information for these purposes to meet our contractual obligations to the corporate partner.

For full details please refer to the Terms and Conditions of Patronage.

You can let us know how you would prefer to be contacted, ask us to update your personal information, or object to receiving our regular communications at any time by contacting the Patrons Team at [email protected].

When you visit the Gallery, we will scan your Patron/Membership card to check your entitlement to free entry, to understand how and when our members visit, and to help us send you more relevant communications. In our legitimate interests to understand our Patrons and Members and provide improved communications and benefits to them, we will carry out demographic profiling and we may use your personal data for marketing, statistical, and analytical purposes.

If you attend an event at the Gallery, we will use the personal data you provide about yourself and any guests that you nominate for the purposes of administering your RSVP, keeping you updated about the event, meeting your individual needs to attend, and managing the event. We use your information for these purposes to fulfil our contractual obligations in providing these services to you, and in the performance of our public task to ensure the safety and security of our guests and staff. We will share any dietary requirements you tell us about with the caterer of an event with your explicit consent to safeguard your health and safety and to ensure your dietary needs are met. For a list of the Gallery’s approved caterers please see our approved suppliers list.

We will share your information with third parties who we have commissioned to act on our behalf in order to fulfil your membership. These include:

  • Tessitura, the CRM provider to store a comprehensive record of your patronage or membership: Tessitura Privacy Policy
  • Bottomline Technologies to verify Direct Debits for Members and Patrons who have chosen this payment option: Bottomline Privacy Policy
  • Experian for address verification: Experian Privacy Policy
  • Wordfly, the e-communications service we use to communicate with our Members and Patrons: Wordfly Privacy Policy
  • Soprano, PS Financials, PCI Pal, Autopay and IP Payaway, where payments are processed.

If you ask us to claim Gift Aid on your membership, we will share your name and address with Her Majesty Revenue and Customs (HMRC) as a legal requirement in order to process the Gift Aid claim.

We will keep your records, including financial transactions and Gift Aid claims, for seven years in line with UK tax law. This is in accordance with our retention schedules and legal compliance. Find out more about our Records Management Policy.

Fundraising, Donations & Legacies

If you make a donation to the Gallery, we will use the personal data you provide for the purposes of recording the nature and amount of your gift, claiming Gift Aid where you have asked us to, and thanking you for your gift. If you interact or have a conversation with us about your donation or support, we will note anything relevant and store this information securely on our systems to ensure we continue to offer you a personalised service and excellent customer care .We use your information for these purposes to meet our legal obligations under UK tax law, and to raise funds as part of our public task to maintain, add to, care for and exhibit portraits under the Museums and Galleries Act 1992.

If you have told us that you are planning to, or are thinking about, leaving the Gallery a gift in your will, we will use the personal data you provide for the purposes of keeping a record of this, including the purpose of your gift. If you interact or have a conversation with us about leaving us a gift, or someone contacts us in relation to your will (e.g. your solicitor), we will note these interactions and store this information securely on our systems, as this helps to ensure your gift is directed as you wanted. We use your information for these purposes to raise funds as part of our public task to maintain, add to, care for and exhibit portraits under the Museums and Galleries Act 1992.

If you have not supported the Gallery before but have consented to receive fundraising information through your e-marketing preferences, we may use your contact details to invite you to support our work by making a donation, getting involved in fundraising activities or leaving a gift in your will.

If you are a current supporter of the Gallery, we may use your contact details to invite you to further support our work by making a donation, getting involved in fundraising activities or leaving a gift in your will. Occasionally, we will invite some supporters to attend special events to tell them more about the ways in which donations and gifts in wills can make a difference to specific projects and to our cause. We will also send you updates on the impact that you make by supporting us in this way, unless you tell us not to. We use your information for these purposes in our legitimate interests to encourage donations from those who are interested and have the ability to support us.

If you tell us you want to fundraise to support our cause, we will use the personal data you provide for the purposes of recording your plans and contacting you to support your fundraising efforts.

If you ask us to claim Gift Aid on your donation, we will share your name and address with Her Majesty Revenue and Customs (HMRC) as a legal requirement in order to process the Gift Aid claim. We will not share your personal information with any other external third parties or organisations.

We will keep your information for the necessary period for the purposes given above, and we will keep records of Gift Aid claims for seven years in line with UK tax law. This is in accordance with our retention schedules and legal compliance.

Please be aware that Charity Commission rules require us to be assured of the provenance of funds and any conditions attached to them, and we are legally required to carry out checks on individuals who give us large donations to prevent money laundering and protect against fraud. To meet these legal obligations, we follow a due diligence process which involves researching the financial soundness, credibility, reputation and ethical principles of donors who have made, or are likely to make, a significant donation to the National Portrait Gallery. This is in accordance with our Grants and Donations Policy.

Supporter research and analysis

We would like to meet with or deepen our connection with individuals and organisations who might have an interest in our work. We are committed to nurturing collaborative relationships with donors, influencers, prospective donors and others so that together we can grow and sustain the Gallery for generations to come.

We may use the information you provide to us in combination with publicly available information to help us find and connect with people with a passion for art, history or creative education projects, and the interest and ability to support us in new and exciting ways, if we consider it within our legitimate interests to do so.

We will use information that is already in the public domain (information that has been published in print or online) for the purpose of identifying high net worth individuals who may be interested in supporting our work with a major gift. These publicly available sources of information include Companies House, the electoral register, the phone book, the Charity Commission’s Register of Charities, Who’s Who, LinkedIn, company annual reports, and articles in newspapers and magazines. We do not use publicly available sources which we consider would be intrusive for this purpose, such as Facebook, Twitter, JustGiving, the Land Registry, online planning applications, or similar websites. We also carry out research to identify existing supporters who may be able to join our major donor programme. This is based both on publicly available information and information our supporters have given us directly, (e.g. where they live, who they bank with, what their occupation is and their age).

Occasionally we use a third party processor, Search & Prosper, to carry out this research on our behalf. To do this, we will share your name with this company and they will provide us with the publicly available information about you that their research has found. See Search & Prosper’s Privacy Policy.

We may use profiling and database segmentation techniques to analyse your personal information and create a profile of your interests, preferences and ability to donate. This allows us to ensure communications are relevant and timely, to provide an improved experience for our supporters. It also helps us understand our supporters so that we can make appropriate requests to those who may be willing and able to donate more than they already do, or leave a gift in their will. This enables us to raise funds in the most cost-effective and least intrusive way.

Under data protection legislation, you have the right to object to your data being processed in this way. If you wish to ask not to be identified as a high net worth individual, or to review or amend your personal data, please contact [email protected].

Please be aware that Charity Commission rules require us to be assured of the provenance of funds and any conditions attached to them, and we are legally required to carry out checks on individuals who give us large donations to prevent money laundering and protect against fraud. To meet these legal obligations, we follow a due diligence process which involves researching the financial soundness, credibility, reputation and ethical principles of donors who have made, or are likely to make, a significant donation to the National Portrait Gallery. This is in accordance with our Grants and Donations Policy.

Shop customer

We collect information about you when you make certain purchases, create a user account or log into the online shop. We will use the personal data you provide (name, contact details, payment details) for the purposes of meeting our contractual obligation to you in fulfilling and communicating with you about your order, processing your payment and delivering your goods.

Where you have created a user account with us, it is in our legitimate interest to contact you with any changes to our systems that might affect the status of your account.

We will keep your information for seven years in order to process your order/transaction, allow us to resolve any issues or disputes with your order, and to keep financial records in line with UK tax law.

Some of the Gallery’s shop services are operated by third parties, and are governed by their own specific terms. Our Privacy Notice does not govern these third parties. We make all reasonable efforts to ensure any third parties the Gallery uses will protect your information in line with UK data protection and privacy laws. However, we will not accept responsibility for third party applications or for any loss or damage arising from your use of them.

We use the following third parties to process transactions:

We will keep details of your purchase and financial information for seven years in accordance with our legal obligations under UK tax law.

Receiving the Shop e-newsletter

We collect information about you when you opt in to receive the Gallery Shop’s e-newsletter and join our mailing list. With your consent we will use the personal data you provide (name and email address) to send you the Shop e-newsletter and email updates. You can withdraw your consent at any time by using the unsubscribe link at the bottom of all e-communications.

We will share your personal information with Mailchimp, who we use to send out the Shop’s e-communications: Mailchimp (intuit) Privacy Policy.

We will keep your personal information to send you the Shop’s e-newsletter and email updates until you unsubscribe or withdraw your consent for this.

Lender, seller or object donor

We collect information about you when you:

  • Offer an object to the Gallery through the following ways - gift, sale, transfer, commission, acceptance in lieu, allocation, bequest or leave an object on temporary deposit
  • Offer to loan an object to the Gallery
  • Correspond with staff or provide information about an object.

Offering an item to the Gallery as a gift, bequest, or on temporary deposit

When you offer an item to the National Portrait Gallery as a gift, bequest or for temporary deposit, we will use the personal data you provide (name and contact details) for the purposes of processing your offer and keeping you informed about the status of it. We use your information for these purposes as part of our public task to acquire works in line with the Museums and Galleries Act 1992, and our legal obligations in relation to copyright.

Where appropriate, we will share your personal information with third parties for the following purposes:

  • Transport companies to arrange transport of the item to and from the Gallery
  • Government Indemnity Scheme or nominated insurer to provide indemnity cover or insurance for loss or damage to the item.
  • National Audit Office to fulfil the Gallery’s legal accounting obligations
  • Capture Ltd, the Gallery’s Rights & Images Digital Asset Management System provider, to record the copyright holder’s details: Capture Privacy Policy.

If your offer is accepted, we will keep your information for permanent preservation in the Gallery Records in order to keep a record of provenance and the Gallery’s acquisition of the item, in line with our legal obligations and our public task under the Museums and Galleries Act 1992.

If your offer is not taken forward, we will keep your information for permanent preservation in the Gallery Records in order to keep a record of works previously offered to the Gallery, and as part of our public task to increase the understanding of and engagement with our Collection and portraiture in general.

Offering an item to the Gallery as a loan

When you offer an item to the National Portrait Gallery as a loan for display, research or an exhibition, we will use the personal data you provide (name and contact details) for the purposes of processing your offer and keeping you informed about the status of it. We use your information for these purposes as part of our public task to ensure portraits are exhibited to the public and made available for study and research in line with the Museums and Galleries Act 1992, and our legal obligations in relation to copyright.

Where appropriate, we will share your personal information with third parties for the following purposes:

  • Transport companies to arrange transport of the item to and from the Gallery
  • Government Indemnity Scheme or nominated insurer to provide indemnity cover or insurance for loss or damage to the item.
  • National Audit Office to fulfil the Gallery’s legal accounting obligations
  • Capture Ltd, the Gallery’s Rights & Images Digital Asset Management System provider, to record the copyright holder’s details: Capture Privacy Policy.

If you offer is accepted, we will keep your information for permanent preservation in the Gallery Records to keep a record of provenance and the Gallery’s acquisition of the item, in line with our legal obligations and our public task under the Museums and Galleries Act 1992.

If your offer is not taken forward, we will keep your information for permanent preservation in the Gallery Records in order to keep a record of works previously offered to the Gallery, and as part of our public task to increase the understanding of and engagement with our Collection and portraiture in general.

Archiving personal data for research purposes

The Gallery will select relevant documents/communications obtained through offers and correspondence with staff about the Gallery’s Collections for permanent preservation and retain records indefinitely for research purposes and archiving in the public interest. Any sensitive information will be withheld from the public.

Prize or award competition entrant

Portrait Award Entries

We collect information about you when you enter prizes or award competitions hosted by the Gallery. We will use the personal data you provide for the purposes of administering your entry, keeping you informed about the judging results, and to organise delivery and collection of your work. We use your information for these purposes as part of our public task to exhibit portraits and to promote the public’s enjoyment and understanding of portraiture. Your data will be held in the Gallery’s competition entry system.

If your work is selected for the second round of judging, we will share your personal information with the nominated art handling agent, in order to arrange the collection and delivery of your work to the Gallery.

At the close of the competition your name, contact details and date of birth will be kept for statistical purposes and to ensure future entries have not been submitted before.

Entrants who have agreed to be sent third-party information will have their contact details shared with the relevant organisations. This information is processed on the basis of consent.

Entries selected for exhibition

If your entry is selected for the exhibition, you will be required to complete a biographical form which includes personal information. This will allow us to produce captions to be used in our exhibition catalogue and for wall labels displayed with your work in the exhibition. We use your information for these purposes as part of our public task to exhibit portraits and to promote the public’s enjoyment and understanding of portraiture.

Your information may be processed by other organisations that we have commissioned to complete work on our behalf, including:

  • Printers, if publications and catalogues are produced.
  • Whitewall access entry system, for arranging couriers and deliveries.
  • Soprano and PS Financials, where payments are made.

Your personal data will be shared with any sponsors involved in the competition. If the exhibition goes on to tour, we will share your personal information with the tour venue(s) in order for them to provide you with an invitation to the private view and/or education events they may hold.

Information relating to successful entrants will be kept for permanent preservation in the Gallery Records for historical research purposes and archiving in the public interest, as well as our public task to keep records of the Gallery’s history under the Public Records Act 1958, 1967.

Other prize draws and competitions

The Gallery periodically runs competitions and prize draws, and will collect your personal data if you enter one of these. Your name and contact details will be processed to contact you in the event that you win, and your data is processed on the basis of consent or legitimate interests. Your information will be processed for as long as required to administer the competition or prize draw. In the event that the competition is being administered jointly with another organisation, your personal data may be shared with that organisation on the basis of your consent.

Sitter

The National Portrait Gallery processes information about its sitters, including their names, contact details, dates of birth, and details about their life and background. Contact details will only be used to contact the sitter where required. Other information may become part of the Collection, which is made available to the public in exhibitions or on the website. Personal data is processed on the basis of the performance of a task in the public interest, namely the Gallery's task defined in the Museums and Galleries Act 1992. Special category data may be included in the biography of a Sitter where this information is made public by the subject, or on the basis of substantial public interest. Personal data that becomes part of the Collection will be retained permanently by the Gallery; other personal data will be stored for as long as required. Sitters' personal data is stored on Mimsy, the Gallery's system used for information related to works and objects.

Rights and Licences

Copyright holders

We collect information about you when you provide us with your details as the owner and/or copyright holder (and/or their representative) for works in the Gallery’s Collections or for works loaned to the Gallery. We will use the personal data you provide to arrange permissions for the Gallery to reproduce the works, to request permissions for third parties to reproduce the works, and to maintain accurate copyright holder information of the works we hold or display in the Collection. We use your information for these purposes in line with our legal obligations under copyright law, and as part of our public task to promote the public’s enjoyment and understanding of portraiture.

The personal information you provide will only be shared with Capture Ltd, who provide and host the Gallery’s Rights & Images Digital Asset Management System: Capture Privacy Policy.

We will keep your details as the copyright holder (or their representative) and records of the permissions you have given for as long as copyright lasts for the work you are copyright holder of. This is to ensure we comply with copyright law, and meet accounting and reporting of royalties requirements.

Notice and Take Down Policy

Please contact us in the event that you are the owner of the copyright or related rights in any of the material on the Gallery’s website, or in a publication or broadcast to which the Gallery has provided material from its collections, and you believe that the material may be subject to a third party ownership or another legal claim; or you believe that the use of this material infringes your intellectual property or any other rights.

We will withdraw the material from our website within 24 hours of receipt of your written objection and our initial verification of your complaint, while the matter is investigated. Your objection will be acknowledged within seven working days of receipt.

Please include the following information in your email:

  • Your contact details
  • The full details of the material you believe has made the infringement and where you found it
  • Proof or statement that you are the rights holder

Please send your query to [email protected] and a member of the Rights & Images team will deal with your enquiry as soon as possible.

Image licensee

We collect information about you when you:

  • Contact the Rights & Images team with an image licensing or copyright enquiry
  • Register on our image licensing website
  • License images via our image licensing website

We will use the personal data you provide to supply a quote and to process your request to order and/or license an image. We use your information for these purposes to meet our contractual obligation to you, or to take the necessary steps to enter into a contract with you.

The personal information you provide will only be shared with Capture Ltd, who provide and host the Gallery’s Rights & Images Digital Asset Management System: Capture Privacy Policy.

We will keep information about your order and/or image license for as long as is reasonably necessary to administer the license and to ensure we comply with copyright law. We will keep records of purchases and financial transactions for seven years in line with our legal obligations under UK tax law.

Other Organisations and Professionals

Cultivating New Partnerships

The Gallery may collect personal data about you if you are an employee from another organisation that may be interested in working with us. This personal data, including name, email address, and phone number, will only be used to contact you regarding prospective work undertaken in partnership with the Gallery, including Touring Exhibitions, on the basis of the performance of a task in the public interest, namely the Gallery’s functions as defined in the Museums and Galleries Act 1992. Your data will be stored in the Gallery’s CRM system, and will be retained for 5 years, or longer if you are involved in ongoing activities.

As the Gallery is subject to the Public Records Act, records may be considered for permanent preservation. If the records that include your data are considered to be historically or culturally significant, your personal data will be anonymised. Your personal data will not be passed on to any third parties.

Prospective Suppliers and Awarded Contracts

The Gallery may collect personal data about you if you apply to work with us as a supplier to enable your employing organisation to bid for tendering opportunities. We will use the information to support communications with you/your organisation regarding expressions of interest, market engagement and potential tendering opportunities; support communications with you/your organisation throughout any tender process your organisation chooses to take part in; support communications with you/your organisation regarding contracts which may be awarded to your organisation; assist us in dealing with any system or tendering queries you/your organisation may have; and raise awareness to you/your organisation of any system updates, developments or any other system related issues.

The legal basis for our use of this information is considered a Public Task in order for the Gallery to meet the requirements of the UK Public Contracts Regulations 2015, and for the performance of the contract if you are a sole trader.

For awarded contracts and successful tenders, your information will be retained for seven years from the end of the contract. Unsuccessful tenders will be held for one year from the award of the contract, to enable us to resolve any queries.

Working with the Gallery on Exhibitions, Events, and Publications

The Gallery will collect information about you if you are working with the Gallery on an exhibition, event, publication, or other activity. The data collected will include your name and contact details, and is processed on the basis of the performance of the contract the Gallery has with you. Depending on the project you are involved in, your data may be processed by the following parties to meet our purposes:

  • Printers, if publications are produced.
  • Transport providers, if works or objects need to be transported.
  • Commercial insurance providers, to ensure all relevant parties and works are appropriately covered.
  • Tessitura, the Gallery’s CRM system.
  • Mimsy, for information related to works and objects.
  • Artifax, for arranging events.
  • Soprano and PS Financials, if payments are processed.

If you are involved in a touring exhibition, your data may be shared with touring venues if the venue will need to make contact with you directly.

Your data will be retained for six years from the end of your contract. As the Gallery is subject to the Public Records Act, records may be considered for permanent preservation. If the records that include your data are considered to be historically or culturally significant, your personal data will be anonymised.

Media Professionals

The Gallery may collect personal data about you if you are a journalist or work in the media, and you may have an interest in the Gallery’s activities. Your personal data, including name, contact details, job role, and areas of interest, will be used to contact you with information regarding the Gallery’s activities. This information is processed on the basis of the legitimate interests of the data subject and the Gallery. Your information will be kept current, and deleted once it is out of date.

The Gallery uses a third party, Cision, to provide this service: Cision’s Privacy Policy.

If you do not wish to receive this information from the Gallery, you can use the unsubscribe link within the Gallery’s emails to opt out.

Trustee

As a Trustee of the Gallery we hold personal information about you (name, date of birth, business and home addresses, contact telephone numbers, e-mail address, copies of ID documents, and a register of interests form) which we will hold securely and will only use this information to facilitate official Trustee business. This is in line with the UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018 and the Gallery’s public task. Your personal data will not be passed to a third party or used for marketing purposes.

To meet the National Audit Office’s requirements you will also be required to supply information about Related Party Transactions and Interests. Information in the former category will be summarised and published in the Gallery’s Annual Report and Accounts. The Gallery maintains a Register of Interests declared which is made available for public inspection upon request.

During your time as a Trustee your name, image and information relating to your profession and other personal interests you have provided to the Gallery will be published on the Gallery’s website under the List of Trustees, and your name will be included in all published meeting minutes. This is in compliance with the Gallery’s public task and obligations under the Freedom of Information Act as a public body.

Personal Data Shared Via the Platform ‘Workplace’

Your personal data will only be collected in so much as any present within documents or information shared on the Workplace platform. If shared documents or information are anonymised by you and then uploaded, the Gallery may still use the document/information but in this instance no personal data will be collected.

The Gallery’s primary objective is to gather collaboratory cross-sector learning. In doing so personal data may also be captured which aids in the understanding of the documents or information being captured.

The lawful basis that applies to this processing is consent.

The Gallery will disclose information collected via the platform in the following ways

  • Project Partners, to support the gathering and dissemination of cross-sector learning and overall delivery of the National Skills Sharing Programme;
  • To third-party service providers that assist in providing the Service or part of the Service;
  • To third-party apps, websites or other services that you can connect to through the Services; To protect the safety of any person; to address fraud, security or technical issues; and In connection with any request or order from a law enforcement agency.

Your personal data will be held for the duration of the National Skills Sharing Partnership until 12 months following the completion of the programme. The Gallery reserves the right to archive information shared within the platform after this date in the interests of public archiving.

The platform is being hosted by Facebook; your data will be stored on servers in the United States and within the EU. The Gallery has taken all necessary precautions to ensure that your rights in terms of data protection will not be compromised by this.

Your personal data will be stored within the Workplace platform. The Gallery reserves the right to store information shared within the platform as part of its permanent archives in its secure IT system.

Staff, prospective staff, and ex-employees

Job applicants

We collect information about you when you create a user account, log in to our recruitment system, or provide information in support of your application to work with the National Portrait Gallery. We will use the personal data you provide to administer your application throughout the recruitment process and to monitor the Gallery’s equal opportunities policy and practices. Find out more about our Equality and Diversity Policy.

By submitting your completed application form you are consenting to your personal data being used and held for the purposes described above.

All recruitment decisions are made in line with our Recruitment Framework. For more information, please see our Recruitment Policy. We do not use your information to make automated decisions regarding your suitability for a role.

Application forms of successful candidates will be kept by the Gallery and will form the basis of the employment contract and personnel record. Application forms of unsuccessful candidates will be kept for a minimum of six months and then securely destroyed.

The Gallery receives your application and personal data via Talent Recruiter (Talentech), our online recruitment solution provider. Your information will not be passed to any other third parties or organisations during the recruitment process.

Job applicants are responsible for ensuring that the information they provide to us is correct, and should log on to the system to correct their data or let us know of any changes as soon as possible. You are able to manage the data you provide via the application gateway, a link to which will be emailed to you once you have started your application. The application gateway allows you to withdraw or delete your application at any time.

Volunteers

We collect information about you when you apply for a volunteer role at the National Portrait Gallery. We will use the personal data you provide for the purposes of contacting you and administering your application. We use your information for these purposes as part of our public task to engage audiences with the Gallery’s work and activities, and it will not be shared with external third parties or any other organisations.

If your application is successful, we will ask you to complete a contact details form, an emergency details form, and an equality monitoring form. These documents, alongside your volunteer application, will be held in your volunteer record. We will use the personal data you provide for administration and health and safety purposes, to communicate with you regarding your volunteering, and to help us monitor the Gallery’s equal opportunities policies and practices. We use your information for these purposes as part of our public task to engage audiences with the Gallery’s work and activities. Your personal information will not be shared with external third parties or any other organisations.

When you stop volunteering with us, we will keep your information for two years to enable us to provide references about your time and activities at the Gallery. After this period, we will delete your personal information from our records in a secure manner. This is in accordance with our retention schedules.

If your application is not successful, we will keep your application form for a maximum of 6 months in case we need to discuss or contact you about your application. We will then delete your personal information from our records in a secure manner.

PhD Students

We collect information about you when you apply for a collaborative doctoral research project with the National Portrait Gallery. Your personal data is shared with us by the partner University, and we will use this for the purposes of contacting you, administering your application, including undertaking a DBS check if you are offered the studentship, and for paying expenses, and ensuring you have appropriate access to undertake the studentship. We use your information for these purposes for the performance of a contract, and as part of our public task to engage audiences with the Gallery’s work and activities. Further information about the way your data will be processed for the purposes of providing you with access can be found in the “Staff, prospective staff, and ex-employees” section of this Privacy Notice.

If your studentship is funded through the REACH consortium as a Collaborate Doctoral Partnership student (CDP), your contact details may be shared within the consortium, with the rest of the REACH student cohort, and to staff at the REACH partners if relevant and after asking permission.

Staff and ex-employees

As an employer, the National Portrait Gallery needs to hold and process personal data relating to its staff in order to meet its contractual, statutory and administrative obligations. The Gallery is committed to protecting your personal information. This Privacy Notice sets out which information is collected about you by the Gallery, how we use it and the choices and controls you have.

This Privacy Notice has been prepared to be as comprehensive as possible, but it does not include an exhaustive list of every aspect of our collection and use of personal information. However, we would be happy to provide any further information or explanation about our practices. If you have any general queries or concerns about this policy, please contact our Data Protection Officer at [email protected].

How we collect your information

We collect information about you from the following sources:

  • Through Medigold, our Occupational Health provider, at the start of and during the course of your employment
  • From your GP for reports, during the course of your employment
  • From your previous employer(s) and nominated referees during reference checks
  • Through a DBS check that will be rerun every 3 years if enhanced and every 5 years if basic.
  • MyCSP and Legal & General, our pension providers
  • Through the Gallery’s CCTV security system
  • Through the Gallery’s Access Control security system.

It is important that the information we hold about you is accurate, therefore please let us know of any changes to the personal information you give to us.

What personal data we process and why

  • Information relating to your employment such as name, address, date of birth, National Insurance number, security clearance, conflict of interest declarations and next of kin details. This is required as part of your employment and so that you can be set up on records, both paper and electronic. You are responsible for ensuring this information is correct and kept up to date
  • Information relating to payment of salary such as your bank details, dates of annual leave and unpaid and paid special, leave, season ticket and bike loans, information relating to family leave such as maternity, paternity or shared parental leave. This also included data requested on pension forms which will be shared with MyCSP and Legal & General, our pension providers. This information is required so that you can be paid the correct amount each month and to ensure that correct records are used when calculating employee benefits.
  • Payments that we are asked to process by third parties such as student loans and CCJ which we are legally required to undertake Information relating to your education and work history, mainly taken from your application form, referees and educational certificates. This is to ensure that pre employment and contractual checks are completed
  • Information related to your sickness absence, such as self certificates and GP Fitness of Statement to Work. This information creates part of your employee cycle and allows us to ensure that support is given where appropriate. This information may be used as part of a Capability process
  • Information relating to work performance such as probation reviews and training records, including on e-learning systems. As part of the employee lifecycle, this is to ensure that up to date and relevant information can be accessed by you, your management and HR. This may be used in both informal and formal processes.
  • A digital photo for you Staff ID and Access Pass.
  • Producing workforce statistics
  • We monitor and record CCTV images for the prevention and detection of crime and to support investigations into reported incidents.

We have further explained in the Appendix how we use your data according to different ways that you may interact with the Gallery.

Our legal bases for processing your data

Under data protection law, we need a lawful basis to collect and use your personal data, depending on the type of processing that we carry out.

We rely on the following lawful basis for processing:

  • a person’s consent (for example, to publish your photo from a staff event on the intranet a contractual relationship (for example, when you sign and return an offer of employment you have entered into a contractual agreement with the Gallery)
  • complying with a legal obligation we have as an employer (for example, to disclose employee salary details to HMRC)
  • completing the Gallery’s public functions as defined by DCMS (for example, in maintaining and providing access to our collections)
  • performing tasks in the public interest (for example, requirements under the Health and Safety at Work Act)
  • protecting an individual’s vital interests (for example, in the event of an accident at the Gallery)
  • the legitimate interests of the Gallery, you as an individual, or wider benefits to society (for example, when providing employment references to prospective employers, or holding emergency contact information)

Where the information we process is special category data, for example your health data or data revealing racial or ethnic origin or trade union membership, the additional legal bases for processing that we rely on are:

  • To carry out our obligations and exercising our rights in employment and
  • the safeguarding of your fundamental rights to protect your vital interests or those of another person where you are incapable of giving your consent
  • for the purposes of preventative or occupational medicine and assessing your working capacity as an employee
  • for the establishment, exercise or defence of legal claims for archiving purposes in the public interest

Sharing your information

For the full list of our current data processors, see Appendix.

Sharing your personal data with Law Enforcement and Emergency Services

The Gallery may receive requests for sharing personal data from relevant authorities such as law enforcement agencies in emergencies to assist with ongoing community policing activities, crime prevention, law enforcement or tax collection. These requests will be considered on a case by case basis, only where the requesting authority demonstrates the necessity and proportionality of their request. We may do so without informing you of the disclosure if doing so would prejudice an investigation.

Sharing your personal data with Insurers

In cases of accidents occurring on the Gallery’s estate, we may need to report the details of the accident to our insurers. This may involve disclosure of your personal data, notably in cases where you, a contractor or visitor has suffered injury and may be in a position to claim damages.

Sharing your personal data with the host organisation of a secondment

The Gallery will share your personal data with the host organisation of any secondment to enable the proper execution of the secondment agreement.

Guidance for staff submitting a Subject Access Request (SAR)

Before asking to be sent a copy of the personal data that we hold about you, staff should note that the Gallery will not routinely supply email messages sent to and from staff, except where they are the focus of that content. This is on the basis that the content is not the members of staff’s personal data, or it is their personal data only in the context of the performance of their duties. The Gallery will not routinely search backups, audit trails, and security logs. If you wish to request such data, you should make such requests explicitly when you submit a Subject Access Request.

If you wish to know what personal information we hold about you or how we process your information, please contact our Data Protection Officer (details below).

Where appropriate, a third party authorised by you is also permitted to submit a Subject Access Request for your personal data on your behalf.

Data Retention

Information about how long we keep your personal data is available in our retention schedule available to all staff.

Data Protection Policy

In addition to this Privacy Notice, all staff should familiarise themselves with the Gallery’s Data Protection Policy, which sets out how the National Portrait Gallery handles the personal data of donors, supporters, suppliers, employees, workers, volunteers and third parties.

Compliance with the Gallery’s Data Protection Policy is a condition of all contracts. The Policy also sets out the rules that all National Portrait Gallery employees, workers, volunteers, contractors, partnership organisations and third parties who process or use any personal information on behalf of the Gallery are subject to in order to ensure that the Gallery is compliant with its data protection obligations.

Please note the Gallery also has a publicly available Privacy Notice, setting out what information is collected about members of the public by the Gallery, how this information is used and the choices and controls members of the public have. If you have also interacted with the Gallery as a member of the public, in addition to being a member of staff, you might like to read this public Privacy Notice for more details.

Appendix

We have provided below some further information on how we use your data according to different ways that you may interact with the Gallery.

Staff and ex-employees

We collect information about you when you are offered employment, when you accept a job offer, and while you are employed at the National Portrait Gallery. We use the personal data that you provide to build and maintain a record of your employment with the Gallery and to enable us to fulfil our contractual, statutory, legal and management obligations and requirements in respect of your employment with us.

If you fail or refuse to provide accurate personal data, this may mean that we are unable to fulfil our contractual, statutory, legal or management obligations and requirements. You should therefore let us know of any changes to your personal data as soon as possible.

With your consent, when you are offered employment we will share your personal information with previous employers and referees you have nominated for reference check purposes.

We are required to share your personal information with other organisations for contractual, statutory and legal reasons. These include:

  • Her Majesty’s Revenue and Customs (HMRC) for tax purposes.
  • MyCSP and Legal & General, the Gallery’s pension scheme administrator, for pension purposes.
  • Natwest, the Gallery’s BACS payment service provider, to pay staff.
  • The Disclosure and Barring Service (DBS) to carry out criminal record checks.
  • Any other third party benefit suppliers that you choose to contribute to via your salary.

To administer your employment and provide you with benefits, support and allowances as part of your contract, we will also share your personal information with other organisations and third parties. These include:

  • Cascade, the Gallery’s payroll system
  • StaffSavvy, the Gallery’s staff scheduling system, if you are in one of the applicable teams
  • Medigold, the Gallery’s occupational health provider: Medigold Privacy Policy
  • SkillGate, the Gallery’s e-learning provider
  • People Insight, the Gallery’s employee survey provider: People Insight Privacy Policy
  • Enjoy Benefits, the Gallery’s childcare voucher provider: Enjoy Benefits Privacy Policy
  • Perkbox, an employee benefits scheme, to provide staff with perks, discounts and freebies: Perkbox Privacy Policy
  • Talmundo (Talentech), the Gallery’s onboarding system

All data shared with the data processors noted above is transferred securely and all external suppliers have signed data processing and confidentiality agreements with the Gallery.

We keep the personal information you provide and that we obtain about you for as long as you are employed at the Gallery. Once your employment ends we keep records relating to your employment, pay and pension for 85 years after birth or 12 years after benefits cease, whichever is greater.

Processing of staff personal data covered in other Gallery policies:

  • Disclosure of staff data when responding to requests made under the Freedom of Information Act (2000) as part of our public task to comply with the requirements of the Act.
  • Monitoring of activity on its systems, including internet and email use, in line with the IT Acceptable Use Policy, for the Gallery’s legitimate purposes.