The rules we have to follow, when we collect your personal data and how long we keep it for
The National Portrait Gallery follows the data protection rules when we collect and use your personal data; there are six of them but we only need to use five. More information on these rules and what they mean can be found on the Information Commissioner’s Office website. Listed below are the five data protection rules we follow and examples of the types of activity they cover and how long we keep your personal data in relation to this activity:
1. The rule of Consent
- If you subscribe to an Enewsletter by email – personal data is kept until you ask us to delete it.
2. The rule of Contract
- If you obtain tickets – personal data is kept for seven years (for financial reasons).
- If you are a shop customer (or any other time you pay for something) – personal data is kept for seven years (for financial reasons).
- If you attend a private event - guest lists are deleted after the event.
- If you choose to be a supporter of the Gallery (as a Member, Patron, donor, sponsor) personal data is kept for seven years (for financial reasons).
3. The rule of Public Task
- If you contact the Gallery by email, phone, post, social media or in person (for example with a general research enquiry) – personal data is kept permanently, but any sensitive personal information will be withheld from the public.
- If you enter any prize or award competition run by the Gallery – personal data is kept permanently so that your displayed or archived work can always be correctly identified.
- If you lend, donate or allow us to display one of your works at the Gallery - personal data is kept permanently so that your displayed or archived work can always be correctly identified.
- When we take pictures in the Gallery or at events, personal data is kept permanently (although Parents/ Guardians will be asked to sign approval forms for children under 13 years old and you can ask not to be photographed).
- Requesting to view works not on display (those held in the Gallery’s onsite stores; Booking information and application form are kept for five years.
- Undertaking research in the Gallery’s Archive & Library personal data is deleted after your visit has ended (usually, at the end of the day).
- If you undertake volunteering or work experience at the Gallery - unsuccessful applications are kept for six months, successful applications are kept for two years from end of placement.
- If you set up a user account for one our services - personal data is kept for as long as needed for the particular account set-up.
- If the Gallery uses work/images that you either own (called copyright) or have rights to – personal data is kept until no longer required or for seven years (for financial reasons).
- CCTV images - personal data is deleted after 30 days.
4. The rule of Vital Interests (which means the rule to Protect someone’s life)
- In the event you require emergency medical care following a serious incident in the Gallery
5. The rule of Legitimate Interests
- Information needed to improve the experience and services we offer - settings can be changed:
- When you visit a page with content embedded from Facebook, SoundCloud, Twitter, YouTube, Google Maps or Flickr, you may be presented with cookies from these websites. The Gallery does not control how these cookies are used. These cookies are set by social media tools or other external applications like those listed above, if you are a user of those services.
Google Analytics - We use Google Analytics to collect information about how our visitors use and navigate the Gallery’s website. This information cannot identify you personally and we only share general data with our funders.