The Gallery holds the most extensive collection of portraits in the world. Search over 215,000 works, 150,000 of which are illustrated from the 16th Century to the present day.

Advanced Collection search

Privacy Notice

The National Portrait Gallery is committed to protecting your personal information. This Privacy Notice sets out which information is collected about you by the Gallery, how we use it and the choices and controls you have.

We will never sell, rent or exchange your details with any other organisation outside the National Portrait Gallery without your prior consent.

This Privacy Notice has been prepared to be as comprehensive as possible, but it does not include an exhaustive list of every aspect of our collection and use of personal information. However, we would be happy to provide any further information or explanation about our practices. If you have any general queries or concerns about this policy, please contact our Data Protection Officer at [email protected].

Changes to this Privacy Notice

From time to time the Gallery will change this privacy notice. You may therefore wish to check this page each time you submit personal information to the Gallery. The latest privacy notice will always appear on this page.

This Privacy Notice was last updated on 14 April 2020.

Who we are

This Privacy Notice applies to the National Portrait Gallery, London (NPG). The Gallery was founded in 1856 to collect and display portraits of people who have contributed to British history and culture. Today the Gallery’s Collection is among the largest and most prestigious collections of portraits in the world. The Gallery is a Non-Departmental Public Body supported by the Department for Culture, Media and Sport (DCMS) and is an exempt charity under the Charities Act 2011. You can find out more about the functions the Gallery by reading our statement of public task here.

The National Portrait Gallery Company Limited (Company Number 06015724) is a wholly owned subsidiary of the Gallery, which was set up to generate income to help the Gallery meet its overall aims and objectives. 

The Gallery’s address is 2 St Martin’s Place, London, WC2H 0HE.

Under this notice, ‘we’, ‘NPG’ and ‘the Gallery’ refers to both the National Portrait Gallery and the National Portrait Gallery Company Limited.

Data protection

The Gallery will only use your personal information in accordance with this Notice, its Data Protection Policy setting out the principles, rules and guidelines its staff need to follow when processing your personal data, and relevant data protection laws including the General Data Protection Regulation, Data Protection Act 2018 and any reiteration of relevant legislations. Our Data Protection registration number is Z5637141.

Our legal bases for processing your data

Under data protection law, we need a lawful basis to collect and use your personal data. The law allows for six ways to process personal data. All of these are relevant to the types of processing that we carry out. This includes information that is processed on the basis of:

  1. a person’s consent (for example, if you consent to receive our e-newsletter)
  2. a contractual relationship (for example, to provide you with goods or services that you have purchased from us, such as a ticket or Membership)
  3. complying with a legal obligation (for example to process a Gift Aid declaration, or carrying out due diligence on large donations)
  4. the Gallery’s public functions as defined by DCMS (for example, in maintaining and providing access to our collections)
  5. protecting an individual’s vital interests (for example, to ensure the safety of staff and visitors to the Gallery)
  6. the legitimate interests of the Gallery, you as an individual, or wider benefits to society (please see below for more information)

Personal data may be legally collected and used if it is necessary for a legitimate interest of the organisation using the data, if its use is fair, and if it does not adversely impact the rights and freedoms of the individual concerned.

When we use your personal information, we will always consider if it is fair and balanced to do so and if it is within your reasonable expectations. We will balance your rights and our legitimate interests to ensure that we use your personal information responsibly and in ways that are not unduly intrusive or unfair.

If you would like more information on our use of legitimate interests, or to change our use of your personal data in this manner, please get in touch with us by contacting our Data Protection Officer at [email protected].

Your rights

We want to ensure you remain in control of your personal data and that you understand your legal rights, which are:

  • the right to know whether we hold your personal data and, if we do so, to be sent a copy of the personal data that we hold about you (known as a ‘Subject Access Request’/SAR) within 30 calendar days;
  • the right to have inaccurate or incomplete personal data updated or amended;
  • the right to have your personal data erased (though this will not apply where it is necessary for us to continue to use the data for a lawful or legitimate reason or to fulfil our obligations under our public task); and
  • the right to object to your personal data being used for marketing or profiling.

Please note yours rights over your personal data are depend on which legal basis is being relied upon by the Gallery. There are some exceptions to the rights above and, although we will always try to respond to any instructions you give us about our handling of your personal information, there may be situations where we are unable to meet your requirements in full.

If you would like further information on your rights or wish to exercise them, please contact our Data Protection Officer (details below).

It is important that the information we hold about you is accurate, therefore please let us know of any changes to the personal information you give to us. Please also get in touch if you wish to know what personal information we hold about you or how we process your information. This is your right of access and is known as a Subject Access Request (SAR). To submit a SAR you can contact us by email at [email protected], or write to us at Data Protection Officer, National Portrait Gallery, St Martin’s Place, London, WC2H 0HE. Please note you will be asked to provide proof of identification.

Questions and complaints

Should you have a question or complaint about how we have used your personal data, you can contact us directly by contacting our Data Protection Officer in the first instance via email at [email protected], or by writing to Data Protection Officer, National Portrait Gallery, St Martin’s Place, London, WC2H 0HE.

If you are not happy with our response, or you believe that your data protection or privacy rights have been infringed, you can complain to the UK Information Commissioner’s Office (ICO) which regulates and enforces data protection law in the UK. Details of how to do this can be found here.

Disclosure of your information

We occasionally use third party data processors for the purpose of distributing communication materials (e.g. a mailing house). Where we do this, we will always undertake due diligence checking and enter into a suitable data processing agreement with the third party organisation enters to ensure your personal information will be processed in accordance with the General Data Protection Regulation and Data Protection Act 2018 and any reiteration of relevant legislations.

We will disclose your personal information to third parties if we are under a duty to disclose or share your personal data in order to comply with any legal obligation; or in order to enforce or apply our Terms and Conditions of Use and other agreements; or to protect the rights, property or safety of the Gallery, our customers or others. This includes exchanging information with other companies and organisations for the purposes of fraud protection.

External Suppliers

In some cases, we work with external suppliers to provide certain services. All data is transferred securely and all external suppliers have signed data sharing and confidentiality agreements with the Gallery.

Storage of your information

The Gallery’s preference is that data we collect from you is stored in the UK/EU (European Union). Where your data is transferred and stored outside the UK/EU we will take all steps reasonably necessary to ensure that any data processor we use provides an adequate level of protection for your data. The transmission of information via the Internet, unfortunately, is not completely secure, and any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to help prevent unauthorised access.

Statistical information

The Gallery will keep records of a statistical nature where personal data will be anonymised, in order to improve our provided services.

How to use this privacy notice

This notice is structured according to different ways that you may interact with the Gallery. Please click on the headings below for further information.

NHS Test and Trace

The following is to explain your rights and give you the information you are entitled to under the Data Protection Act 2018.

1. The identity and contact details of National Portrait Gallery and our data protection officer   

The Board of Trustees of the National Portrait Gallery (National Portrait Gallery) is the data controller. The Gallery’s Data Protection Officer can be contacted on [email protected].    

2. Why we are collecting the data  

Your personal data is being collected to support the NHS Test and Trace programme. By maintaining records of staff, suppliers, contractors and visitors to the Gallery, and sharing these with NHS Test and Trace where requested, we can help to identify people who may have been exposed to COVID-19.

For this purpose, you will be asked to provide some basic information and contact details when visiting the Gallery or accessing Gallery premises (other than for drop-off deliveries). The following information will be collected:

  • The name of any person visiting or accessing Gallery premises. If it is a group of people (for example, but not limited to, a private tour of the Gallery or a Library & Archive Talk), then only the name of one member of the group and number of people in the group may be recorded.
  • A contact phone number for each individual, or for the lead member of a group of people.
  • Date of visit, arrival time and, where possible, departure time.

In addition, when visitors interact with only one member of staff during their visit, the name of the assigned staff member will be recorded alongside the visitor’s name.

Young persons personal data will also be collected for this purpose.

3. Legal basis for processing the data 

Data protection legislation sets out when we are lawfully allowed to process your data. The lawful basis that applies to this processing is:

  • Legitimate interests – Processing is necessary for the purposes of the legitimate interests of the Gallery namely to assist the NHS Test and Trace programme to maintain a safe operating environment and help fight any local outbreak of the coronavirus.

4. With whom we will be sharing the data

The Gallery will only ever share the data collected for the purpose of contact tracing with NHS Test and Trace if it is specifically requested by them (for example, if another visitor reported symptoms and subsequently tested positive, NHS Test and Trace can request the log of customer details for a particular time period).

Your personal data will only be used for this purpose and no other. It should be noted that to ensure information is not shared incorrectly or to malicious parties the Gallery will follow Government guidelines. The Gallery will only share personal data to approved and published NHS Test and Trace contact details. 

5. For how long we will keep the personal data, or criteria used to determine the retention period.

Personal data collected for the purpose of contact tracing will be destroyed by us 21 days after the date of your visit.

NHS Test and Trace have asked us to retain this information for 21 days from the date of your visit, to enable contact tracing to be carried out by NHS Test and Trace during that period.

6. Your rights, e.g. access, rectification, erasure

The data we are collecting is your personal data, and you have rights that affect what happens to it. You have the right to:

  1. know that we are using your personal data
  2. see what data we have about you
  3. ask to have your data corrected
  4. ask to have your data deleted
  5. complain to the ICO (see below)

If you do not wish your contact information to be passed to NHS Test and Trace if requested, please speak to the Gallery’s Head of Operations.

7. Sending data overseas

Your personal data will not be sent overseas.

8. Automated decision making

We will not use your data for any automated decision making.

9. Storage, security and data management

Your personal data will be stored in a secure IT system managed by the Gallery.

10. Complaints and more information

When we ask you for information, we will keep to the law, including the Data Protection Act 2018 and the General Data Protection Regulation.

If you are unhappy with the way the Gallery has acted or are not happy with how we are using your personal data, you should contact the Gallery in the first instance on the following: [email protected].

If you are still not happy, or for independent advice about data protection, privacy and data sharing, you can contact:

The Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow, Cheshire,
SK9 5AF
Telephone: 0303 123 1113 or 01625 545 745
https://ico.org.uk/

Visitor to the Gallery

Photographs in the Gallery and at events

The Gallery reserves the right to take photographs in public and gallery spaces and at events. Individuals should notify staff if they do not wish to be photographed. All reasonable efforts will be made to gain approval (usually via a consent form) from the subject of any image of an identifiable person which the Gallery publishes in print or online. Parents/ Guardians will be asked to sign approval forms for children under 13 years old.

CCTV

The Gallery uses CCTV to monitor the building and the area as part of our public task to protect our Collections, visitors and staff. In the event of a security incident, CCTV footage (which may include images of you) will be shared with the police and/or local authorities where it is our legal obligation and is appropriate to do so.

Unless it is required by police and/or local authorities for their investigations, CCTV footage is deleted after 30 days.

Ticket Purchase

We collect information about you when you:

  • Purchase a ticket
  • Book an event
  • Create a user account or log into the ticketing section of our website

We will use the personal data you provide for the purposes of processing your ticket purchase or booking, providing you with assistance through our customer service team, keeping you informed about your booking and any changes, and asking for feedback about your experience. We use your information for these purposes to fulfil our contractual obligations in providing these services to you.

When you make a purchase, we will share your personal information with the following third parties:

  • Transaction Network Services (TNS), the payment solution provider for ticketing card transactions - https://www.tnsi.com/Privacy
  • Her Majesty Revenue and Customs (HMRC) to process Gift Aid on your purchase if you ask us to claim it.
  • Other organisations in order to detect and reduce card fraud and credit risk.

We will keep details of your purchase and financial information for seven years in accordance with our legal obligations under UK tax law. Find out more about our Records Management Policy here.

Once your personal information is no longer required we will delete it from our records in a secure manner. Not all records can be deleted immediately; The Gallery has statutory, legal, business continuity and administrative requirements to hold on to certain records for specified periods.

Contacting the Gallery

We collect information about you when you make an enquiry, provide feedback or send us an e-mail or letter. We will use the personal data you provide (name and contact details) in order to respond to you and take any necessary action. We use your information for these purposes as part of our public task to promote the public’s enjoyment and understanding of portraiture, and to maintain a collection of portraits of people who have contributed to British history and culture.

The personal information you provide for these purposes will not be shared with external third parties or any other organisations.

We will keep your information for up to three months after your last meaningful contact with the Gallery, and then your enquiry, complaint or feedback will be anonymised. This is in accordance with our retention schedules and legal compliance. Find out more about our Records Management Policy here.

Once your personal information is no longer required we will delete it from our records in a secure manner. Not all records can be deleted immediately; The Gallery has statutory, legal, business continuity and administrative requirements to hold on to certain records for specified periods.

Improving the experience and services offered to visitors

The Gallery has legitimate interests in learning more about its visitors, how they interact with the Collections and why they come to the Gallery; as well as generally improving the experience for and services offered to visitors. For these reasons we will use your personal data to:

  • Learn about your interests and preferences so that we are able to personalise your experience and contact you, with your consent, about programme or product information that is relevant to you.
  • Use booking and publicly available information to classify our audience into groups or segments. These segments help us to understand our audience better and ensure we are sending relevant messages to each group.
  • Analyse and continually improve the services we offer.
  • Measure and understand how our audiences respond to a variety of marketing activity so we can ensure our activity is well targeted, relevant and effective.

Onsite Third Party Service Providers

Some of the Gallery’s onsite services are operated by third parties, and are governed by their own specific terms. Our Privacy Notice does not govern these third parties. We make all reasonable efforts to ensure any third parties the Gallery uses will protect your information in line with UK data protection and privacy laws. However, we will not accept responsibility for third party applications or for any loss or damage arising from your use of them.

We use the following third parties to process transactions onsite:

Please note the Portrait Restaurant and Portrait Café are run by a third party, Company of Cooks (Public Restaurant Partner Ltd). When you make a booking with the Portrait Restaurant or sign up to receive the Restaurant’s e-newsletter, your personal data is being held and used by Company of Cooks for these purposes - http://www.companyofcooks.com/privacy.

Attending a private event

We collect information about you when you RSVP to a private event hosted by the National Portrait Gallery, including the names and contact details of any guests that you nominate. We will use the personal data you provide for the purposes of administering your RSVP, keeping you updated about the event, meeting your individual needs to attend, and managing the event. We use your information for these purposes to fulfil our contractual obligations in providing these services to you, and in the vital interest of the safety and security of our guests and staff.

Please note, if you attend a private event held at the Gallery that is hosted by a third-party, the organiser of the event will collect your information and will only provide the Gallery with a list of guest names. This is for security purposes and to allow you access to the event. We use your information for these purposes to fulfil our contractual obligations to the event organiser, and in the vital interest of the safety and security of guests and staff.

Occasionally, we will use contact details that we hold or that are available in the public domain to invite individuals who have a specific interest or involvement in the Gallery to attend special events. We use your information for these purposes in our legitimate interests to promote the Gallery, its exhibitions and its services; and to deepen our connection with individuals and organisations who might have an interest in the Gallery’s work.

We will share your information with zkipster, the Gallery’s guest list management provider, to manage the guest list and to check you in when you arrive at an event - https://www.zkipster.com/privacy-policy/. Guest lists are deleted from zkipster the day after the event.

We will share any dietary requirements you tell us about with the caterer of an event, to safeguard your health and safety and to ensure your dietary needs are met. For a list of the Gallery’s approved caterers please see our approved suppliers list here.

If the event you attend includes an auction, you will be asked to register your name and email address to take part. We will share this information with Givergy, the Gallery’s auction service provider, for the purposes of registering and managing your bids and pledges - https://www.givergy.com/uk/fundraise/site-policy/. Payments of winning bids and pledges will be processed directly by the Gallery.

Your personal information will be kept for as long as is required for reference and the purposes given above. This is in accordance with our retention schedules. Find out more about our Records Management Policy here.

Once your personal information is no longer required, we will delete it from our records in a secure manner. Not all records can be deleted immediately; The Gallery has statutory, legal, business continuity and administrative requirements to hold on to certain records for specified periods.

Website user

Cookies

Cookies are small data files that a website can transfer to an individual’s computer hard drive for record keeping. Cookies can make websites easier to use by storing information about your preferences on a particular website. The information may remain on your computer after the Internet session finishes and you leave the website but you can delete them using some browsers, manually or using system utilities. Most internet browsers are pre-set to accept cookies.

If you wish to restrict or block the cookies, which are set by NPG websites, or any other website, you can do this through your browser settings. The Help function within your browser should tell you how. For more information on cookies and their uses, visit the cookies page on the Information Commissioner’s Office website.

Most elements of the Gallery’s website will still function if you disable cookies in your web browser settings.

In general, we use cookies in the following ways:

  • Temporary, ‘session’ cookies to help you navigate through our website and to enhance your user experience. These cookies are temporary and disappear when you close your browser.
  • Analytics cookies to recognise and count visits to our website, how visitors use our website and how they get to the website. This information is used to help improve the website and services provided. Information collected in this way does not personally identify you.
  • Third Party cookies may be set by social media tools or other external applications if you are a user of those services. For example, when you visit a page with content embedded from Facebook, SoundCloud, Twitter, YouTube, Google Maps or Flickr, you may be presented with cookies from these websites. The Gallery does not control the dissemination of these cookies. You should check the third-party websites for more information about these.

See the full list of Cookies in use for:

npg.org.uk my.npg.org.uk npgshop.org.uk npgimages.com librarycatalogue.npg.org.uk britishportraits.org.uk

Other websites, web applications and third party service providers

Our website may contain links to third party websites or applications. Our Privacy Notice does not govern these websites or applications. These applications are owned and operated by third parties, and are governed by their own specific terms. We make all reasonable efforts to ensure any third parties the Gallery uses will protect your information in line with UK data protection and privacy laws. However, we will not accept responsibility for third party applications or for any loss or damage arising from your use of them.

We use the following third parties to process transactions online:

Please note the Portrait Restaurant and Portrait Café are run by a third party, Company of Cooks (Public Restaurant Partner Ltd). When you make a booking with the Portrait Restaurant or sign up to receive the Restaurant’s e-newsletter, your personal data is being held and used by Company of Cooks for these purposes - http://www.companyofcooks.com/privacy.

Google Analytics

We use Google Analytics to collect information about how our visitors use and navigate the Gallery’s website. We use this information to report to funders such as the Department for Culture, Media and Sport (DCMS), and to analyse usage of the website so that we can continually work to improve the site and your experience of it. The cookies collect information such as the number of visitors to the site, which pages they visited and whereabouts they came to the site from. This information is anonymous and cannot be used to identify you personally.

Personalised advertising

If you browse the Gallery’s website, you may receive personalised banner advertisements whilst browsing other reputable websites or social media platforms. The Gallery has a legitimate interest in marketing our activities to those with an existing interest in the Gallery to help raise income. We are committed to providing you with information on products and offers which are relevant to you. The banner advertisements will relate to exhibition pages, events or products which have been viewed whilst browsing the Gallery’s website on your computer or other device. This service is provided by the Gallery via reputable third-party specialist companies like Sizmek and Quantcast, through the use of cookies placed on your computer or other device. These companies may choose to target you based on your IP host address and non-Personally Identifiable Information (Non-PII). This includes but is not limited to the date and time of activity online, the pages viewed, browser type, referring URL, Internet Service Provider and operating system. These companies do not collect Personally Identifiable Information (PII) such as name, address, phone number, email address or credit card information.

You can visit these individual companies and read their privacy policies for more information on how to opt out. The Sizmek privacy policy and Quantcast privacy policy are available online.

You may also opt out of receiving further personalised advertisements in the future by clicking on the bottom right hand corner of any advertisement you receive and following the instructions.

User Accounts

We collect information about you when you create a user account and log in to the following website services:

  • Ticket purchase/event booking
  • Making a donation
  • Membership or Patronage
  • Online shop
  • Applying for a job
  • Licensing an image
  • Subscribing to the e-newsletter

We will keep your information for the necessary period for the above purposes in accordance with our retention schedules and legal compliance. For more information, please see the relevant section(s) of this Privacy Notice and find out more about our Records Management Policy here.

Once your personal information is no longer required we will delete it from our records in a secure manner. Not all records can be deleted immediately; The Gallery has statutory, legal, business continuity and administrative requirements to hold on to certain records for specified periods.

Surveys

We occasionally run surveys to improve our website and services. Cookies are used to allow the form or pop-up survey to be hidden on your return visits. This is to prevent you from being shown the survey again unnecessarily. Cookies are also used to record the overall number of answers to the survey questions and to link these to web statistics. They do not store your personal data.

Ticket Purchase

We collect information about you when you purchase a ticket, book an event, create a user account or log into the ticketing section of our website. Please see the Visitors to the Gallery section of this Privacy Notice for further information.

Contacting the Gallery

We collect information about you when you make an enquiry, provide feedback or send us a message via the website or an email enquiry form. We will use the personal data you provide (name and contact details) in order to respond to you and take any necessary action. We use your information for these purposes as part of our public task to promote the public’s enjoyment and understanding of portraiture, and to maintain a collection of portraits of people who have contributed to British history and culture.

Your personal information you provide for these purposes will not be shared with external third parties or any other organisations.

We will keep your information for up to three months after your last meaningful contact with the Gallery, and then your enquiry, complaint or feedback will be anonymised. This is in accordance with our retention schedules and legal compliance. Find out more about our Records Management Policy here.

Once your personal information is no longer required we will delete it from our records in a secure manner. Not all records can be deleted immediately; The Gallery has statutory, legal, business continuity and administrative requirements to hold on to certain records for specified periods.

Competitions

Winners of competitions are notified directly by the Gallery, unless stated otherwise in the competition Terms & Conditions. The National Portrait Gallery Marketing Department keep information gathered through web competitions for three months on a secure local server. Entrants who have agreed to be sent third-party information have their contact details sent to the relevant organisations. Entrants who have declined to receive further information will have their contact details deleted from the server after three months.

Links to non-National Portrait Gallery websites

The Gallery accepts no responsibility or liability for content on third party websites. Users clicking on links to external sites should check the Terms and Conditions and Privacy Policy of the site they are visiting.

Enewsletter subscriber

We collect information about you when you opt in to receive the Gallery e-newsletter/s and join our mailing list. With your consent we will use the personal data you provide (name and email address) to send you the relevant e-newsletters and email updates. You can withdraw your consent at any time by using the unsubscribe link at the bottom of all e-communications.

When you sign up to the Gallery’s mailing list you can tell us your preferences for what you want to hear about. You can update your preferences at any time by logging into your account here. If you opted in to receive the Gallery e-newsletter/s when you signed into our onsite public Wifi, please email [email protected] to register your preferences.

We will share your personal information with third parties who we use to send out our e-communications. These are:

We will keep your personal information to send you the Gallery e-newsletters and email updates until you unsubscribe or withdraw your consent for this. Once your personal information is no longer required we will delete it from our records in a secure manner. Not all records can be deleted immediately; The Gallery has statutory, legal, business continuity and administrative requirements to hold on to certain records for specified periods.

Please note the Portrait Restaurant and Portrait Café are run by a third party, Company of Cooks (Public Restaurant Partner Ltd). When you sign up to receive the Restaurant’s e-newsletter, your personal data is being held and used by Company of Cooks for these purposes - http://www.companyofcooks.com/privacy.

Marketing communications

You have the right to ask us not to process your personal data for direct marketing purposes (e.g. providing you with information about the Gallery’s programme of exhibitions and events, shop products or fundraising initiatives). We will inform you before collecting your data if we intend to use your personal information for such purposes. You can stop us using your data in this way at any time by exercising your right to object to processing and contacting us at [email protected].

Once your personal information is no longer required we will delete it from our records in a secure manner. Not all records can be deleted immediately; The Gallery has statutory, legal, business continuity and administrative requirements to hold on to certain records for specified periods.

Supporter of the Gallery (inc. Members & Patrons)

The Gallery is an exempt charity under the Charities Act 2011 and must self-generate 60% of its income. This includes fundraising, and we rely on the generosity of our supporters and sponsors to continue our work.

We use a customer relationship management system (CRM) to support our fundraising activities and to deliver an excellent service to our Members, Donors and supporters. This means that we keep the personal data you provide us with, so that we are able to see the history and relevant details of your relationship with the Gallery.

We collect information about you when you:

  • Sign up to become a Member or Patron
  • Make a donation to the Gallery and/or ask us to claim Gift Aid
  • Leave the Gallery a gift in your will
  • Fundraise to support the Gallery

Members

When you sign up to become a Member, we will use the personal data you provide (name, contact details, payment details) for the purposes of administering your membership, processing your membership subscription payment, providing you with your membership benefits, sending you updates about events, benefits, services, special offers and fundraising activities, and contacting you when your membership is due to expire and if there is an issue with your membership or payment. We use your information for these purposes to meet our contractual obligations to you, and in our legitimate interests to keep you updated about activities at the Gallery and your membership.

For full details please refer to the Terms and Conditions of Membership here.

To help us to provide the best level of service and offers to our Members, every two years we will invite you to participate in the Members Survey online. You can let us know how you would prefer to be contacted, ask us to update your personal information, or object to receiving these communications at any time through your Member Account online or by contacting the Membership team at [email protected].

If you purchase a Membership for somebody else as a gift, we will use your personal data to set up and service the Membership. If you are the recipient of a Gift Membership, we will let you know who gave us your information and make you aware of this Privacy Notice and how to manage your communication preferences in your Welcome Letter.

When you visit the Gallery, we will scan your Membership card to check your entitlement to free entry, to understand how and when our members visit, and to help us send you more relevant communications. In our legitimate interests to understand our members and provide improved communications and benefits to them, we will carry out demographic profiling and we may use your personal data for marketing, statistical, and analytical purposes.

We will share your information with third parties who we have commissioned to act on our behalf in order to fulfil your membership. These include:

If you ask us to claim Gift Aid on your membership, we will share your name and address with Her Majesty Revenue and Customs (HMRC) as a legal requirement in order to process the Gift Aid claim.

We will keep your information for the necessary period to process and administer your Membership, and we will keep records of financial transactions and Gift Aid claims for seven years in line with UK tax law. This is in accordance with our retention schedules and legal compliance. Find out more about our Records Management Policy here.

Once your personal information is no longer required we will delete it from our records in a secure manner. Not all records can be deleted immediately; The Gallery has statutory, legal, business continuity and administrative requirements to hold on to certain records for specified periods.

Patrons, Life Patrons, Director’s Circle, Corporate Members

When you sign up to become a Patron, a Life Patron, or a member of the Director’s Circle we will use the personal data you provide (name, contact details, payment details) for the purposes of administering your membership, processing your membership subscription payment, providing you with your membership benefits, sending you updates about benefits, services, and fundraising activities, inviting you to special events, and contacting you when your membership is due to expire and if there is an issue with your membership or payment. We use your information for these purposes to meet our contractual obligations to you, and in our legitimate interests to keep you updated about activities at the Gallery and your membership.

If you are affiliated with the Gallery through a corporate membership, we will use your work-based contact details and corporate accounts information to process payment and administer your corporate membership. We use your information for these purposes to meet our contractual obligations to the corporate partner.

For full details please refer to the Terms and Conditions of Patronage here.

You can let us know how you would prefer to be contacted, ask us to update your personal information, or object to receiving our regular communications at any time by contacting the Patrons Team at [email protected] or the Corporate Team at [email protected].

When you visit the Gallery, we will scan your Patron/Membership card to check your entitlement to free entry, to understand how and when our members visit, and to help us send you more relevant communications. In our legitimate interests to understand our Patrons and Members and provide improved communications and benefits to them, we will carry out demographic profiling and we may use your personal data for marketing, statistical, and analytical purposes.

If you attend an event at the Gallery, we will use the personal data you provide about yourself and any guests that you nominate for the purposes ofadministering your RSVP, keeping you updated about the event, meeting your individual needs to attend, and managing the event. We use your information for these purposes to fulfil our contractual obligations in providing these services to you, and in the vital interest of the safety and security of our guests and staff. We will share your information with zkipster, the Gallery’s guest list management provider, to manage the guest list and to check you in when you arrive at an event - https://www.zkipster.com/privacy-policy/. We will share any dietary requirements you tell us about with the caterer of an event, to safeguard your health and safety and to ensure your dietary needs are met. For a list of the Gallery’s approved caterers please see our approved suppliers list here.

We will share your information with third parties who we have commissioned to act on our behalf in order to fulfil your membership. These include:

If you ask us to claim Gift Aid on your membership, we will share your name and address with Her Majesty Revenue and Customs (HMRC) as a legal requirement in order to process the Gift Aid claim.

We will keep your information for up to a year after your Patronage expiry date to allow you to easily re-join, and we will keep records of financial transactions and Gift Aid claims for seven years in line with UK tax law. This is in accordance with our retention schedules and legal compliance. Find out more about our Records Management Policy here.

Once your personal information is no longer required we will delete it from our records in a secure manner. Not all records can be deleted immediately; the Gallery has statutory, legal, business continuity and administrative requirements to hold on to certain records for specified periods.

Fundraising, Donations & Legacies

If you make a donation to the Gallery, we will use the personal data you provide for the purposes of recording the nature and amount of your gift, claiming Gift Aid where you have asked us to, and thanking you for your gift. If you interact or have a conversation with us about your donation or support, we will note anything relevant and store this information securely on our systems to ensure we continue to offer you a personalised service and excellent customer care .We use your information for these purposes to meet our legal obligations under UK tax law, and to raise funds as part of our public task to maintain, add to, care for and exhibit portraits under the Museums and Galleries Act 1992.

If you have told us that you are planning to, or are thinking about, leaving the Gallery a gift in your will, we will use the personal data you provide for the purposes of keeping a record of this, including the purpose of your gift. If you interact or have a conversation with us about leaving us a gift, or someone contacts us in relation to your will (e.g. your solicitor), we will note these interactions and store this information securely on our systems, as this helps to ensure your gift is directed as you wanted. We use your information for these purposes to raise funds as part of our public task to maintain, add to, care for and exhibit portraits under the Museums and Galleries Act 1992.

If you have not supported the Gallery before but have consented to receive fundraising information through your e-marketing preferences, we may use your contact details to invite you to support our work by making a donation, getting involved in fundraising activities or leaving a gift in your will.

If you are a current supporter of the Gallery, we may use your contact details to invite you to further support our work by making a donation, getting involved in fundraising activities or leaving a gift in your will. Occasionally, we will invite some supporters to attend special events to tell them more about the ways in which donations and gifts in wills can make a difference to specific projects and to our cause. We will also send you updates on the impact that you make by supporting us in this way, unless you tell us not to. We use your information for these purposes in our legitimate interests to encourage donations from those who are interested and have the ability to support us.

If you tell us you want to fundraise to support our cause, we will use the personal data you provide for the purposes of recording your plans and contacting you to support your fundraising efforts.

If you ask us to claim Gift Aid on your donation, we will share your name and address with Her Majesty Revenue and Customs (HMRC) as a legal requirement in order to process the Gift Aid claim. We will not share your personal information with any other external third parties or organisations.

We will keep your information for the necessary period for the purposes given above, and we will keep records of Gift Aid claims for seven years in line with UK tax law. This is in accordance with our retention schedules and legal compliance. Find out more about our Records Management Policy here.

Once your personal information is no longer required we will delete it from our records in a secure manner. Not all records can be deleted immediately; the Gallery has statutory, legal, business continuity and administrative requirements to hold on to certain records for specified periods.

Please be aware that Charity Commission rules require us to be assured of the provenance of funds and any conditions attached to them, and we are legally required to carry out checks on individuals who give us large donations to prevent money laundering and protect against fraud. To meet these legal obligations, we follow a due diligence process which involves researching the financial soundness, credibility, reputation and ethical principles of donors who have made, or are likely to make, a significant donation to the National Portrait Gallery. This is in accordance with our Grants and Donations Policy.

Supporter research and analysis

We would like to meet with or deepen our connection with individuals and organisations who might have an interest in our work. We are committed to nurturing collaborative relationships with donors, influencers, prospective donors and others so that together we can grow and sustain the Gallery for generations to come.

We may use the information you provide to us in combination with publicly available information to help us find and connect with people with a passion for art, history or creative education projects, and the interest and ability to support us in new and exciting ways, if we consider it within our legitimate interests to do so.

We will use information that is already in the public domain (information that has been published in print or online) for the purpose of identifying high net worth individuals who may be interested in supporting our work with a major gift. These publicly available sources of information include Companies House, the electoral register, the phone book, the Charity Commission’s Register of Charities, Who’s Who, LinkedIn, company annual reports, and articles in newspapers and magazines. We do not use publicly available sources which we consider would be intrusive for this purpose, such as Facebook, Twitter, JustGiving, the Land Registry, online planning applications, or similar websites. We also carry out research to identify existing supporters who may be able to join our major donor programme. This is based both on publicly available information and information our supporters have given us directly, (e.g. where they live, who they bank with, what their occupation is and their age).

Occasionally we use a third party processor, Search & Prosper, to carry out this research on our behalf. To do this, we will share your name with this company and they will provide us with the publicly available information about you that their research has found. A copy of Search & Prosper’s Privacy Policy can be found here.

We may use profiling and database segmentation techniques to analyse your personal information and create a profile of your interests, preferences and ability to donate. This allows us to ensure communications are relevant and timely, to provide an improved experience for our supporters. It also helps us understand our supporters so that we can make appropriate requests to those who may be willing and able to donate more than they already do, or leave a gift in their will. This enables us to raise funds in the most cost-effective and least intrusive way.

Under data protection legislation, you have the right to object to your data being processed in this way. If you wish to ask not to be identified as a high net worth individual, or to review or amend your personal data, please contact [email protected].

Please be aware that Charity Commission rules require us to be assured of the provenance of funds and any conditions attached to them, and we are legally required to carry out checks on individuals who give us large donationsto prevent money laundering and protect against fraud. To meet these legal obligations, we follow a due diligence process which involves researching the financial soundness, credibility, reputation and ethical principles of donors who have made, or are likely to make, a significant donation to the National Portrait Gallery. This is in accordance with our Grants and Donations Policy.

Shop customer

We collect information about you when you make certain purchases, create a user account or log into the online shop. We will use the personal data you provide (name, contact details, payment details) for the purposes of meeting our contractual obligation to you in fulfilling and communicating with you about your order, processing your payment and delivering your goods.

Where you have created a user account with us, it is in our legitimate interest to contact you with any changes to our systems that might affect the status of your account.

We will keep your information for seven years in order to process your order/transaction, allow us to resolve any issues or disputes with your order, and to keep financial records in line with UK tax law. This is in accordance with our retention schedules and legal compliance. Find out more about our Records Management Policy here.

Once your personal information is no longer required we will delete it from our records in a secure manner. Not all records can be deleted immediately; The Gallery has statutory, legal, business continuity and administrative requirements to hold on to certain records for specified periods.

Third Party Service Providers

Some of the Gallery’s shop services are operated by third parties, and are governed by their own specific terms. Our Privacy Notice does not govern these third parties. We make all reasonable efforts to ensure any third parties the Gallery uses will protect your information in line with UK data protection and privacy laws. However, we will not accept responsibility for third party applications or for any loss or damage arising from your use of them.

We use the following third parties to process transactions:

Receiving the Shop e-newsletter

We collect information about you when you opt in to receive the Gallery Shop’s e-newsletter and join our mailing list. With your consent we will use the personal data you provide (name and email address) to send you the Shop e-newsletter and email updates. You can withdraw your consent at any time by using the unsubscribe link at the bottom of all e-communications.

We will share your personal information with Mailchimp, who we use to send out the Shop’s e-communications -https://mailchimp.com/legal/privacy/.

We will keep your personal information to send you the Shop’s e-newsletter and email updates until you unsubscribe or withdraw your consent for this. Once your personal information is no longer required we will delete it from our records in a secure manner. Not all records can be deleted immediately; The Gallery has statutory, legal, business continuity and administrative requirements to hold on to certain records for specified periods.

Restaurant customer

The Gallery’s Portrait Restaurant and Portrait Café are run by a third party, Company of Cooks (Public Restaurant Partner Ltd). Company of Cooks will collect information about you when you make a booking with the Portrait Restaurant & Bar or when you agree to receive the Restaurant’s e-newsletter. Your personal data is therefore held and used by Company of Cooks for these purposes, not the National Portrait Gallery.

For more information, please see Company of Cooks’s Privacy Notice - http://www.companyofcooks.com/privacy

Lender, seller or object donor

We collect information about you when you:

  • Offer an object to the Gallery through the following ways - gift, sale, transfer, acceptance in lieu, allocation, bequest or leave an object on temporary deposit
  • Offer to loan an object to the Gallery
  • Correspond with staff or provide information about an object

Offering an item to the Gallery as a gift, bequest, or on temporary deposit

When you offer an item to the National Portrait Gallery as a gift, bequest or for temporary deposit, we will use the personal data you provide (name and contact details) for the purposes of processing your offer and keeping you informed about the status of it. We use your information for these purposes as part of our public task to acquire works in line with the Museums and Galleries Act 1992, and our legal obligations in relation to copyright.

Where appropriate, we will share your personal information with third parties for the following purposes:

  • Transport companies to arrange transport of the item to and from the Gallery
  • Government Indemnity Scheme or nominated insurer to provide indemnity cover or insurance for loss or damage to the item.
  • National Audit Office to fulfil the Gallery’s legal accounting obligations
  • Capture Ltd, the Gallery’s Rights & Images Digital Asset Management System provider, to record the copyright holder’s details - https://www.capture.co.uk/privacy-policy/

If your offer is accepted, we will keep your information for permanent preservation in the Gallery Records in order to keep a record of provenance and the Gallery’s acquisition of the item, in line with our legal obligations and our public task under the Museums and Galleries Act 1992.

If your offer is not taken forward, we will keep your information for permanent preservation in the Gallery Records in order to keep a record of works previously offered to the Gallery, and as part of our public task to increase the understanding of and engagement with our Collection and portraiture in general. This is in accordance with our retention schedules and legal compliance. Find out more about our Records Management Policy here.

Once your personal information is no longer required we will delete it from our records in a secure manner. Not all records can be deleted immediately; The Gallery has statutory, legal, business continuity and administrative requirements to hold on to certain records for specified periods.

Offering an item to the Gallery as a loan

When you offer an item to the National Portrait Gallery as a loan for display, research or an exhibition, we will use the personal data you provide (name and contact details) for the purposes of processing your offer and keeping you informed about the status of it. We use your information for these purposes as part of our public task to ensure portraits are exhibited to the public and made available for study and research in line with the Museums and Galleries Act 1992, and our legal obligations in relation to copyright.

Where appropriate, we will share your personal information with third parties for the following purposes:

  • Transport companies to arrange transport of the item to and from the Gallery
  • Government Indemnity Scheme or nominated insurer to provide indemnity cover or insurance for loss or damage to the item.
  • National Audit Office to fulfil the Gallery’s legal accounting obligations
  • Capture Ltd, the Gallery’s Rights & Images Digital Asset Management System provider, to record the copyright holder’s details - https://www.capture.co.uk/privacy-policy/

If you offer is accepted, we will keep your information for permanent preservation in the Gallery Records to keep a record of provenance and the Gallery’s acquisition of the item, in line with our legal obligations and our public task under the Museums and Galleries Act 1992.

If your offer is not taken forward, we will keep your information for permanent preservation in the Gallery Records in order to keep a record of works previously offered to the Gallery, and as part of our public task to increase the understanding of and engagement with our Collection and portraiture in general. This is in accordance with our retention schedules and legal compliance. Find out more about our Records Management Policy here.

Once your personal information is no longer required we will delete it from our records in a secure manner. Not all records can be deleted immediately; The Gallery has statutory, legal, business continuity and administrative requirements to hold on to certain records for specified periods.

Archiving personal data for research purposes

The Gallery will select relevant documents/communications obtained through offers and correspondence with staff about the Gallery’s Collections for permanent preservation and retain records indefinitely for research purposes and archiving in the public interest. Any sensitive information will be withheld from the public.

Prize or award competition entrant

We collect information about you when you enter the BP Portrait Award or Taylor Wessing Photographic Portrait Prize, or any other prize or award competition hosted by the Gallery. We will use the personal data you provide for the purposes of administering your entry, keeping you informed about the judging results, and to organise delivery and collection of your work. We use your information for these purposes as part of our public task to exhibit portraits and to promote the public’s enjoyment and understanding of portraiture.

If your work is selected for the second round of judging, we will share your personal information with the nominated art handling agent, in order to arrange the collection and delivery of your work to the Gallery.

At the close of the competition your name, contact details and date of birth will be kept for statistical purposes and to ensure future entries have not been submitted before. This is in accordance with our retention schedules and legal compliance. Find out more about our Records Management Policy here.

Once your personal information is no longer required we will delete it from our records in a secure manner. Not all records can be deleted immediately; The Gallery has statutory, legal, business continuity and administrative requirements to hold on to certain records for specified periods.

Entries selected for exhibition

If your entry is selected for the exhibition, you will be required to complete a biographical form which includes personal information. This will allow us to produce captions to be used in our exhibition catalogue and for wall labels displayed with your work in the exhibition. We use your information for these purposes as part of our public task to exhibit portraits and to promote the public’s enjoyment and understanding of portraiture.

If the exhibition goes on to tour, we will share your personal information with the tour venue(s) in order for them to provide you with an invitation to the private view and/or education events they may hold.

Information relating to successful entrants will be kept for permanent preservation in the Gallery Records for historical research purposes and archiving in the public interest, as well as our public task to keep records of the Gallery’s history under the Public Records Act 1958, 1967. This is in accordance with our retention schedules and legal compliance. Find out more about our Records Management Policy here.

Once your personal information is no longer required we will delete it from our records in a secure manner. Not all records can be deleted immediately; The Gallery has statutory, legal, business continuity and administrative requirements to hold on to certain records for specified periods.

Copyright holder

We collect information about you when you provide us with your details as the owner and/or copyright holder (and/or their representative) for works in the Gallery’s Collections or for works loaned to the Gallery. We will use the personal data you provide to arrange permissions for the Gallery to reproduce the works, to request permissions for third parties to reproduce the works, and to maintain accurate copyright holder information of the works we hold or display in the Collection. We use your information for these purposes in line with our legal obligations under copyright law, and as part of our public task to promote the public’s enjoyment and understanding of portraiture.

The personal information you provide will only be shared with Capture Ltd, who provide and host the Gallery’s Rights & Images Digital Asset Management System - https://www.capture.co.uk/privacy-policy/

We will keep your details as the copyright holder (or their representative) and records of the permissions you have given for as long as copyright lasts for the work you are copyright holder of. This is to ensure we comply with copyright law, and meet accounting and reporting of royalties requirements. This is in accordance with our retention schedules and legal compliance. Find out more about our Records Management Policy here.

Once your personal information is no longer required we will delete it from our records in a secure manner. Not all records can be deleted immediately; The Gallery has statutory, legal, business continuity and administrative requirements to hold on to certain records for specified periods.

Notice and Take Down Policy

Please contact us in the event that you are the owner of the copyright or related rights in any of the material on the Gallery’s website, or in a publication or broadcast to which the Gallery has provided material from its collections, and you believe that the material may be subject to a third party ownership or another legal claim; or you believe that the use of this material infringes your intellectual property or any other rights.

We will withdraw the material from our website within 24 hours of receipt of your written objection and our initial verification of your complaint, while the matter is investigated. Your objection will be acknowledged within seven working days of receipt.

Please include the following information in your email:

  • Your contact details
  • The full details of the material you believe has made the infringement and where you found it
  • Proof or statement that you are the rights holder

Please send your query to [email protected] and a member of the Rights & Images team will deal with your enquiry as soon as possible.

Image licensee

We collect information about you when you:

  • Contact the Rights & Images team with an image licensing or copyright enquiry
  • Register on our image licensing website
  • License images via our image licensing website

We will use the personal data you provide to supply a quote and to process your request to order and/or license an image. We use your information for these purposes to meet our contractual obligation to you, or to take the necessary steps to enter into a contract with you.

The personal information you provide will only be shared with Capture Ltd, who provide and host the Gallery’s Rights & Images Digital Asset Management System - https://www.capture.co.uk/privacy-policy/

We will keep information about your order and/or image license for as long as is reasonably necessary to administer the license and to ensure we comply with copyright law. We will keep records of purchases and financial transactions for seven years in line with our legal obligations under UK tax law. This is in accordance with our retention schedules and legal compliance. Find out more about our Records Management Policy here.

Once your personal information is no longer required we will delete it from our records in a secure manner. Not all records can be deleted immediately; The Gallery has statutory, legal, business continuity and administrative requirements to hold on to certain records for specified periods.

Archive and library user

We collect information about you when you:

  • Book an appointment to visit the Heinz Archive & Library
  • Complete a Visitor Agreement form to register as a user of the Heinz Archive & Library or view an object not on display
  • Make a research enquiry or correspond with staff

Visitors to the Heinz Archive and Library

When you make a request to visit the Heinz Archive & Library, we will use the personal data you provide (name and contact details) for the purposes of processing your booking, keeping you informed about your appointment and any changes, and to allow a visitor pass to be created for the day of your visit. We use your information for these purposes as part of our public task to make our resources available to researchers, and in the vital interest of safety and security.

When you first visit the Heinz Archive & Library, you will be required to complete a Visitor Agreement form with your personal information. This is to allow you access to the Heinz Archive and Library and the material it holds, to record your agreement to abide by the conditions the forms sets out, and to contact you after your visit in the event of any issues or concerns. These purposes fall within our public task to make our resources available to researchers, and our legal obligations in relation to copyright and data protection.

The personal information you provide as a visitor to the Heinz Archive & Library will not be shared with external third parties or any other organisations.

Your visitor pass and associated information will be deleted on the date your access expires (usually at the end of the day of your visit). We will keep your booking information for two years and a copy of your Visitor Agreement form for six years for the above purposes, in accordance with our retention schedules and legal compliance. Find out more about our Records Management Policy here.

Once your personal information is no longer required we will delete it from our records in a secure manner. Not all records can be deleted immediately; The Gallery has statutory, legal, business continuity and administrative requirements to hold on to certain records for specified periods.

Making a Research Enquiry

When you make a research enquiry or correspond with staff regarding British portraits, the history of the Gallery or items in the Gallery’s Collections, we will use the personal data you provide (name and contact details) for the purposes of recording your enquiry and responding to your request. We use your information for these purposes as part of our public task to make our resources available to researchers, and it will not be shared with external third parties or any other organisations.

Enquiries and correspondence regarding items not in the Gallery’s Collections or which are of no ongoing research value will be deleted three years after the last meaningful correspondence on that subject. Enquiries and correspondence regarding items in the Gallery’s Collections, or that the Gallery deems to be important for historical or research purposes will be kept for permanent preservation in the Gallery Records. This is for archiving in the public interest purposes, and any sensitive information will be withheld from the public. This is in accordance with our retention schedules and legal compliance. Find out more about our Records Management Policy here.

Once your personal information is no longer required we will delete it from our records in a secure manner. Not all records can be deleted immediately; The Gallery has statutory, legal, business continuity and administrative requirements to hold on to certain records for specified periods.

Archiving personal data for research purposes

The Gallery will select relevant documents/communications obtained through public research enquiries and correspondence with staff about the Gallery’s Collections for permanent preservation and retain records indefinitely for research purposes and archiving in the public interest. Any sensitive information will be withheld from the public.

Visitor to view works not on display

We collect information about you when you:

  • Book an appointment to view items not on display
  • Complete an application form to view items not on display
  • Make a research enquiry or correspond with staff

Visitors to view Primary Collection works not on display

When you make a request to view works in the National Portrait Gallery’s Primary Collection which are currently not on display, we will use the personal data you provide (name and contact details) for the purposes of processing your booking, keeping you informed about your appointment and any changes, and to allow a visitor pass to be created for the day of your visit. We use your information for these purposes as part of our public task to make our collections available to researchers and for the public’s enjoyment, and in the vital interest of safety and security.

For each and every visit to our stores (a facility shared with Tate), you will be required to complete an application form with your personal information. This is to allow you supervised access to the stores and the material it holds, to record your agreement to abide by the conditions the form sets out, and to contact you after your visit in the event of any issues or concerns. These purposes fall within our public task to make our collections available to researchers and for the public’s enjoyment.

The personal information you provide as a visitor to the stores will only be shared with:

  • Tate Security, to administer your visit to the Gallery’s external store (if applicable) in Southwark
  • The referees you nominate in your application, should further checks be required (you should get permission from your referees to provide their details to the Gallery for this purpose)

If you visited the Heinz Archive & Library and/or the Gallery’s other stores based in Orange Street, your visitor pass and associated information will be deleted on the date your access expires (usually at the end of the day of your visit). If you visited the Gallery’s external store in Southwark as part of your enquiry, this building is managed by Tate and so your details will be held in line with Tate’s retention schedule - https://www.tate.org.uk/about-us/policies-and-procedures/tate-privacy-policy.

We will keep your booking information and a copy of your application form for five years in accordance with our retention schedules and legal compliance. Overall numbers of visits to see works on display may be collected for statistical and analytical purposes. Find out more about our Records Management Policy here.

Once your personal information is no longer required we will delete it from our records in a secure manner. Not all records can be deleted immediately; The Gallery has statutory, legal, business continuity and administrative requirements to hold on to certain records for specified periods.

Visitors to view Reference Collection Photographs

When you make a request to view photographs from the National Portrait Gallery’s Reference Collection, you will be treated as a visitor to the Heinz Archive & Library. We will use the personal data you provide (name and contact details) for the purposes of processing your booking, keeping you informed about your appointment and any changes, and to allow a visitor pass to be created for the day of your visit. We use your information for these purposes as part of our public task to make our collections available to researchers and for the public’s enjoyment, and in the vital interest of safety and security.

When you first visit the Heinz Archive & Library, you will be required to complete a Visitor Agreement form with your personal information. This is to allow you access to the Heinz Archive and Library and the material it holds, to record your agreement to abide by the conditions the forms sets out, and to contact you after your visit in the event of any issues or concerns. These purposes fall within our public task to make our resources available to researchers, and our legal obligations in relation to copyright and data protection.

The personal information you provide as a visitor to the Heinz Archive & Library will not be shared with external third parties or any other organisations.

Your visitor pass and associated information will be deleted on the date your access expires (usually at the end of the day of your visit). We will keep your booking information for two years and a copy of your Visitor Agreement form for six years for the above purposes, in accordance with our retention schedules and legal compliance. Find out more about our Records Management Policy here.

Once your personal information is no longer required we will delete it from our records in a secure manner. Not all records can be deleted immediately; The Gallery has statutory, legal, business continuity and administrative requirements to hold on to certain records for specified periods.

Making a Research Enquiry

When you make a research enquiry or correspond with staff regarding British portraits, the history of the Gallery or items in the Gallery’s Collections, we will use the personal data you provide (name and contact details) for the purposes of recording your enquiry and responding to your request. We use your information for these purposes as part of our public task to make our resources available to researchers, and it will not be shared with external third parties or any other organisations.

Enquiries and correspondence regarding items not in the Gallery’s Collections or which are of no ongoing research value will be deleted three years after the last meaningful correspondence on that subject. Enquiries and correspondence regarding items in the Gallery’s Collections, or that the Gallery deems to be important for historical or research purposes will be kept for permanent preservation in the Gallery Records. This is for archiving in the public interest purposes, and any sensitive information will be withheld from the public. This is in accordance with our retention schedules and legal compliance. Find out more about our Records Management Policy here.

Once your personal information is no longer required we will delete it from our records in a secure manner. Not all records can be deleted immediately; The Gallery has statutory, legal, business continuity and administrative requirements to hold on to certain records for specified periods.

Archiving personal data for research purposes

The Gallery will select relevant documents/communications obtained through public research enquiries and correspondence with staff about the Gallery’s Collections for permanent preservation and retain records indefinitely for research purposes and archiving in the public interest. Any sensitive information will be withheld from the public

Job applicant

We collect information about you when you create a user account, log in to our recruitment system, or provide information in support of your application to work with the National Portrait Gallery. We will use the personal data you provide to administer your application throughout the recruitment process and to monitor the Gallery’s equal opportunities policy and practices. Find out more about our Equality and Diversity Policy here.

By submitting your completed application form you are consenting to your personal data being used and held for the purposes described above.

All recruitment decisions are made in line with our Recruitment Framework. For more information, please see our Recruitment Policy here. We do not use your information to make automated decisions regarding your suitability for a role.

Application forms of successful candidates will be kept by the Gallery and will form the basis of the employment contract and personnel record. Application forms of unsuccessful candidates will be kept for a minimum of six months and then securely destroyed. This is in accordance with our retention schedules. Not all records can be deleted immediately; the Gallery has statutory, legal, business continuity and administrative requirements to hold on to certain records for specified periods. Find out more about our Records Management policy here.

The Gallery receives your application and personal data via Vacancy Filler, our online recruitment solution provider - https://www.vacancy-filler.co.uk/privacy-policy/. Your information will not be passed to any other third parties or organisations during the recruitment process.

Job applicants are responsible for ensuring that the information they provide to us is correct, and should log on to the system to correct their data or let us know of any changes as soon as possible. You are able to manage the data you provide via the application gateway, a link to which will be emailed to you once you have started your application. The application gateway allows you to withdraw or delete your application at any time.

Staff and ex-employees

As an employer, the National Portrait Gallery needs to hold and process personal data relating to its staff in order to meet its contractual, statutory and administrative obligations. The Gallery is committed to protecting your personal information. This Privacy Notice sets out which information is collected about you by the Gallery, how we use it and the choices and controls you have.

This Privacy Notice has been prepared to be as comprehensive as possible, but it does not include an exhaustive list of every aspect of our collection and use of personal information. However, we would be happy to provide any further information or explanation about our practices. If you have any general queries or concerns about this policy, please contact our Data Protection Officer at [email protected].

Changes to this Privacy Notice

From time to time the Gallery will change this privacy notice. You may therefore wish to check this page each time you submit personal information to the Gallery. The latest privacy notice will always appear on this page.

This Privacy Notice was last updated on 6 July 2020.

Who we are

This Privacy Notice applies to the National Portrait Gallery, London (NPG). The Gallery was founded in 1856 to collect and display portraits of people who have contributed to British history and culture. Today the Gallery’s Collection is among the largest and most prestigious collections of portraits in the world. The Gallery is a Non-Departmental Public Body supported by the Department for Digital, Culture, Media and Sport (DCMS) and is an exempt charity under the Charities Act 2011. You can find out more about the functions the Gallery by reading our statement of public task here.

The National Portrait Gallery Company Limited (Company Number 06015724) is a wholly owned subsidiary of the Gallery, which was set up to generate income to help the Gallery meet its overall aims and objectives. 

The Gallery’s address is 2 St Martin’s Place, London, WC2H 0HE.

Under this notice, ‘we’, ‘NPG’ and ‘the Gallery’ refers to both the National Portrait Gallery and the National Portrait Gallery Company Limited.

Data protection

The Gallery will only use your personal information in accordance with this Notice, its Data Protection Policy, and relevant data protection laws including the General Data Protection Regulation, Data Protection Act 2018 and any reiteration of relevant legislations. Our Data Protection registration number is Z5637141.

How we collect your information

We collect information about you from the following sources:

  • Directly from you when setting you up as an employee and throughout your employment cycle (for example through self service)
  • Through Medigold, our Occupational Health provider, at the start of and during the course of your employment
  • From your GP for reports, during the course of your employment
  • From your previous employer(s) and nominated referees during reference checks
  • Through a DBS check that will be rerun every 3 years if enhanced and every 5 years if basic.
  • MyCSP, our pension providers
  • Through the Gallery’s CCTV security system
  • Through the Gallery’s Access Control security system.

What personal data we process and why

  • Information relating to your employment such as name, address, date of birth, National Insurance number, security clearance, conflict of interest declarations and next of kin details. This is required as part of your employment and so that you can be set up on records, both paper and electronic. You are responsible for ensuring this information is correct and kept up to date
  • Information relating to payment of salary such as your bank details, dates of annual leave and unpaid and paid special, leave, season ticket and bike loans, information relating to family leave such as maternity, paternity or shared parental leave. This also included data requested on pension forms which will be shared with MyCSP, our pension providers. This information is required so that you can be paid the correct amount each month and to ensure that correct records are used when calculating employee benefits
  • Payments that we are asked to process by third parties such as student loans and CCJ which we are legally required to undertake
  • Information relating to your education and work history, mainly taken from your application form, referees and educational certificates. This is to ensure that pre employment and contractual checks are completed
  • Information related to your sickness absence, such as self certificates and GP Fitness of Statement to Work. This information creates part of your employee cycle and allows us to ensure that support is given where appropriate. This information may be used as part of a Capability process
  • Information relating to work performance such as probation reviews and training records, including on e-learning systems. As part of the employee lifecycle, this is to ensure that up to date and relevant information can be accessed by you, your management and HR. This may be used in both informal and formal processes
  • A digital photo for you Staff ID and Access Pass.
  • We monitor and record CCTV images for the prevention and detection of crime and to support investigations into reported incidents.

We have further explained at Appendix 1 how we use your data according to different ways that you may interact with the Gallery.

Our legal bases for processing your data

Under data protection law, we need a lawful basis to collect and use your personal data, depending on the type of processing that we carry out.

We rely on the following lawful basis for processing:

  • a person’s consent (for example, to collect employee references)
  • a contractual relationship (for example, when you sign and return an offer of employment you have entered into a contractual agreement with the Gallery)
  • complying with a legal obligation we have as an employer (for example, to disclose employee salary details to HMRC)
  • the Gallery’s public functions as defined by DCMS (for example, in maintaining and providing access to our collections)
  • protecting an individual’s vital interests (for example, to ensure the safety of staff and visitors to the Gallery)
  • the legitimate interests of the Gallery, you as an individual, or wider benefits to society (for example, when processing your data for administrative purposes)

Where the information we process is special category data, for example your health data or data revealing racial or ethnic origin or trade union membership, the additional legal bases for processing that we rely on are:

  • To carry out our obligations and exercising our rights in employment and the safeguarding of your fundamental rights
  • to protect your vital interests or those of another person where you are incapable of giving your consent
  • for the purposes of preventative or occupational medicine and assessing your working capacity as an employee
  • for the establishment, exercise or defence of legal claims
  • for archiving purposes in the public interest

Sharing your information

For the full list of our current data processors, see Appendix 2.

Sharing your personal data with Law Enforcement and Emergency Services

The Gallery may receive requests for sharing personal data from relevant authorities such as law enforcement agencies in emergencies to assist with ongoing community policing activities, crime prevention, law enforcement or tax collection. These requests will be considered on a case by case basis, only where the requesting authority demonstrates the necessity and proportionality of their request. We may do so without informing you of the disclosure if doing so would prejudice an investigation.

Sharing your personal data with Insurers

In cases of accidents occurring on the Gallery’s estate, we may need to report the details of the accident to our insurers. This may involve disclosure of your personal data, notably in cases where you, a contractor or visitor has suffered injury and may be in a position to claim damages.

Sharing your personal data with the host organisation of a secondment

The Gallery will share your personal data with the host organisation of any secondment to enable the proper execution of the secondment agreement.

Your rights

We want to ensure you remain in control of your personal data and that you understand your legal rights, which are:

  • the right to know whether we hold your personal data and, if we do so, to be sent a copy of the personal data that we hold about you (a ‘Subject Access Request’/SAR);
  • the right to have inaccurate or incomplete personal data updated or amended;
  • the right to have your personal data erased; the right to restrict the processing of your information;
  • the right to object to your personal data being processed.
  • the right to receive your data in a format that can be transferred to another data controller (however this right is limited to data which you have provided directly to us).

There are some exceptions to the rights above, based on the legal basis used to process your personal data, and, although we will always try to respond to any instructions you give us about our handling of your personal information, there may be situations where we are unable to meet your requirements in full.

If you would like further information on your rights or wish to exercise them, please contact our Data Protection Officer (details below).

It is important that the information we hold about you is accurate, therefore please let us know of any changes to the personal information you give to us.

Guidance for staff submitting a Subject Access Request (SAR).

Before asking to be sent a copy of the personal data that we hold about you, staff should note that the Gallery will not routinely supply email messages sent to and from staff, except where they are the focus of that content. This is on the basis that the content is not the members of staff’s personal data, or it is their personal data only in the context of the performance of their duties. The Gallery will not routinely search backups, audit trails, and security logs. If you wish to request such data, you should make such requests explicitly when you submit a Subject Access Request.

If you wish to know what personal information we hold about you or how we process your information, please contact our Data Protection Officer (details below).

Where appropriate, a third party authorised by you is also permitted to submit a Subject Access Request for your personal data on your behalf.

Questions and complaints

Should you have a question or complaint about how we have used (‘processed’) your personal data, you can contact us directly by contacting our Data Protection Officer in the first instance via email at [email protected], or by writing to Data Protection Officer, National Portrait Gallery, St Martin’s Place, London, WC2H 0HE.

If you are not happy with our response, or you believe that your data protection or privacy rights have been infringed, you also have the right to complain to the UK Information Commissioner’s Office (ICO) which regulates and enforces data protection law in the UK. Details of how to do this can be found here.

Data Retention

Information about how long we keep your personal data is available in our retention schedule available to all staff.

Storage of your information

The Gallery’s preference is that data we collect from you is stored in the UK/EU (European Union). Where your data is transferred and stored outside the UK/EU we will take all steps reasonably necessary to ensure that any data processor we use provides an adequate level of protection for your data. The transmission of information via the Internet, unfortunately, is not completely secure, and any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to help prevent unauthorised access.

Statistical information

The Gallery will keep records of a statistical nature where personal data will be anonymised, in order to improve our provided services.

Data Protection Policy

In addition to this Privacy Notice, all staff should familiarise themselves with the Gallery’s Data Protection Policy, which sets out how the National Portrait Gallery handles the personal data of donors, supporters, suppliers, employees, workers, volunteers and third parties. Compliance with the Gallery’s Data Protection Policy is a condition of all contracts. The Policy also sets out the rules that all National Portrait Gallery employees, workers, volunteers, contractors, partnership organisations and third parties who process or use any personal information on behalf of the Gallery are subject to in order to ensure that the Gallery is compliant with its data protection obligations.

Please note the Gallery also has a publicly available Privacy Notice, setting out what information is collected about members of the public by the Gallery, how this information is used and the choices and controls members of the public have. If you have also interacted with the Gallery as a member of the public, in addition to being a member of staff, you might like to read this public Privacy Notice for more details: https://www.npg.org.uk/footer/privacy-cookies

Appendix 1

We have provided below some further information on how we use your data according to different ways that you may interact with the Gallery. Please click on the headings below (if this is presented as drop down menu):

Job applicants
We collect information about you when you create a user account, log in to our recruitment system, or provide information in support of your application to work with the National Portrait Gallery. We will use the personal data you provide to administer your application throughout the recruitment process and to monitor the Gallery’s equal opportunities policy and practices. Find out more about our Equality and Diversity Policy here.

By submitting your completed application form you are consenting to your personal data being used and held for the purposes described above.

All recruitment decisions are made in line with our Recruitment Framework. For more information, please see our Recruitment Policy here. We do not use your information to make automated decisions regarding your suitability for a role.

Application forms of successful candidates will be kept by the Gallery and will form the basis of the employment contract and personnel record. Application forms of unsuccessful candidates will be kept for a minimum of six months and then securely destroyed. This is in accordance with our retention schedules. Not all records can be deleted immediately; the Gallery has statutory, legal, business continuity and administrative requirements to hold on to certain records for specified periods. Find out more about our Records Management policy here.

The Gallery receives your application and personal data via Vacancy Filler, our online recruitment solution provider - https://www.vacancy-filler.co.uk/privacy-policy/. Your information will not be passed to any other third parties or organisations during the recruitment process.

Job applicants are responsible for ensuring that the information they provide to us is correct, and should log on to the system to correct their data or let us know of any changes as soon as possible. You are able to manage the data you provide via the application gateway, a link to which will be emailed to you once you have started your application. The application gateway allows you to withdraw or delete your application at any time.

Staff and ex-employees

We collect information about you when you are offered employment, when you accept a job offer, and while you are employed at the National Portrait Gallery. We use the personal data that you provide to build and maintain a record of your employment with the Gallery and to enable us to fulfil our contractual, statutory, legal and management obligations and requirements in respect of your employment with us.

If you fail or refuse to provide accurate personal data, this may mean that we are unable to fulfil our contractual, statutory, legal or management obligations and requirements. You should therefore let us know of any changes to your personal data as soon as possible.

With your consent, when you are offered employment we will share your personal information with previous employers and referees you have nominated for reference check purposes.

We are required to share your personal information with other organisations for contractual, statutory and legal reasons. These include:

  • Her Majesty’s Revenue and Customs (HMRC) for tax purposes.
  • My CSP, the Gallery’s pension scheme administrator, for pension purposes.
  • Natwest, the Gallery’s BACS payment service provider, to pay staff.
  • The Disclosure and Barring Service (DBS) to carry out criminal record checks.
  • Any other third party benefit suppliers that you choose to contribute to via your salary.

To provide you with benefits, support and allowances as part of your contract, we will also share your personal information with other organisations and third parties. These include:

All data shared with the data processors noted above is transferred securely and all external suppliers have signed data processing and confidentiality agreements with the Gallery.

We keep the personal information you provide and that we obtain about you for as long as you are employed at the Gallery. Once your employment ends we keep records relating to your employment, pay and pension for 85 years after birth or 12 years after benefits cease, whichever is greater. This is in accordance with our retention schedule and legal obligations. Find out more about our Records Management Policy here.

Not all records can be deleted immediately; the Gallery has statutory, legal, business continuity and administrative requirements to hold on to certain records for specified periods.

CCTV images

The Gallery processes CCTV in both public and back of house areas to monitor the building and the area as part of our public task to protect our Collections, visitors and staff. In the event of a security incident, CCTV footage (which may include images of you) will be shared with the police and/or local authorities where it is our legal obligation and is appropriate to do so.

CCTV images of you may be used to provide supporting evidence in staff investigations or disciplinary hearings. The Gallery does not use CCTV to monitor staff performance. The Gallery’s CCTV systems are only operated by holders of valid Public Space Surveillance licenses issued by the Security Industry Authority (SIA). The SIA is regulated by the UK Home Office.

Images may also be reviewed for official purposes when investigating an incident and the National Portrait Gallery complies with the Information Commissioner’s (ICO) and the Surveillance Camera Commissioner’s CCTV Code of Practice.

The CCTV Code of Practice documents that the Gallery comply with can be found here:

  • Surveillance Camera Commissioner:

 https://ico.org.uk/media/for-organisations/documents/1542/cctv-code-of-practice.pdf

It should be noted that CCTV images are only stored for 30 days as determined by the Gallery’s Retention Schedule. Exceptions may apply in cases where images are required to be saved for longer periods to support active investigations or, following an incident, for a limited period to satisfy legal statutes of limitations.

Test and Trace programme

By maintaining records of staff working at the Gallery, and sharing these with NHS Test and Trace where requested, we can help to identify people who may have been exposed to COVID-19.

The following staff information will be collected and may be shared with NHS Test and Trace for contact monitoring purposes:

  • Names of staff working at Gallery premises.
  • A contact phone number for each member of staff.
  • The dates and times that staff are in the building.

For more information on how the Gallery uses your personal data to support NHS Test and Trace, please see the relevant Privacy Notice on the Gallery’s website.

Processing of staff personal data covered in other Gallery policies:

  • Disclosure of staff data when responding to requests made under the Freedom of Information Act (2000) as part of our public task to comply with the requirements of the Act.
  • Monitoring of activity on its systems, including internet and email use, in line with the IT Acceptable Use Policy, for the Gallery’s legitimate purposes.

Volunteer

We collect information about you when you apply for a volunteer role at the National Portrait Gallery. We will use the personal data you provide for the purposes of contacting you and administering your application. We use your information for these purposes as part of our public task to engage audiences with the Gallery’s work and activities, and it will not be shared with external third parties or any other organisations.

If your application is successful, we will ask you to complete a contact details form, an emergency details form, and an equality monitoring form. These documents, alongside your volunteer application, will be held in your volunteer record. We will use the personal data you provide for administration and health and safety purposes, to communicate with you regarding your volunteering, and to help us monitor the Gallery’s equal opportunities policies and practices. We use your information for these purposes as part of our public task to engage audiences with the Gallery’s work and activities. Your personal information will not be shared with external third parties or any other organisations.

When you stop volunteering with us, we will keep your information for two years to enable us to provide references about your time and activities at the Gallery. After this period, we will delete your personal information from our records in a secure manner. This is in accordance with our retention schedules.

If your application is not successful, we will keep your application form for a maximum of 6 months in case we need to discuss or contact you about your application. We will then delete your personal information from our records in a secure manner. This is in accordance with our retention schedules.

Find out more about our Records Management Policy here. Not all records can be deleted immediately; The Gallery has statutory, legal, business continuity and administrative requirements to hold on to certain records for specified periods.

Making an Information Request

Freedom of Information Act enquiries

When you make a Freedom of Information Act enquiry, any formal compliant on the handling of your enquiry (for example requesting an internal review) or correspond with staff with respect to any request you have submitted, we will use the personal data you provide (name and contact details) for the purposes of recording your enquiry and responding to your request.

We use your information for these purposes as it is within our public task to comply with the requirements of the Freedom of Information Act (2000).

Personal data you supply will not be shared with external third parties or any other organisations during the initial stages of your enquiry. During the course of any Information Commissioner investigations and higher (tribunal) the Gallery will be required to share personal data in order to fully assist the regulator with the fulfilment of their functions. 

Your personal data will be kept for a period of 3 years after the last meaningful contact with respect to your enquiry; after such time your personal data will be deleted from our systems. Anonymised information relevant to your enquiry maybe kept permanently for statistical reasons only.

Please also note that any information you supply to the Gallery (personal or otherwise) will thereby be held by the Gallery and thus subject to the terms of the Freedom of Information Act. It is highly likely that personal data supplied to the Gallery as part of a Freedom of Information request (or in deed for any other reason) would be exempt from disclosure.

Your right of access (Making a Subject Access Request)

When you ask us whether or not we are using or storing your personal information, or for copies of your personal information, this is commonly known called as Subject Access Request (SAR). When you submit a SAR or correspond with staff with respect to any request you have submitted, we will use the personal data you provide (name, contact details, and  proof of identity and any further information you choose to provide) for the purposes of recording and responding to your request. We use your information for these purposes as part of our public task to comply with the Data Protection Act 2018 and the General data Protection Regulation (GDPR).

We will not share the personal information you provide when you submit a SAR with external third parties or any other organisations when we respond to your request. In response to any Information Commissioner investigations, the Gallery may be required to share personal data to fully assist the regulator with the fulfilment of their functions. 

Proof of your identity will be retained by the Gallery for one year, after which it will be destroyed. The Gallery retains case files for individual SARs for three years from receipt, after which they will be destroyed. Anonymised information relevant to your SAR maybe kept permanently for statistical reasons only.

Once your personal information is no longer required we will delete it from our records in a secure manner. Not all records can be deleted immediately; The Gallery has statutory, legal, business continuity and administrative requirements to hold on to certain records for specified periods.

Read our Child and Young People policy