What information do we collect when you visit the Gallery and how do we collect it?
The personal data we collect on your visit may include:
- your name and contact details given in relation to your comments, queries, feedback, or responses to surveys conducted while you are at the Gallery;
- credit card or other payment information given in relation to donations made at the Gallery;
- images of you recorded on our CCTV cameras;
- images captured on film or photography taken in the Gallery; and
- MAC (Media Access Control) addresses of any device(s) you bring with you to the Gallery, whether or not you have connected to the Gallery’s free public Wi-Fi service. MAC addresses are identifiers which any Wi-Fi enabled device transmits whilst searching for a Wi-Fi connection.
How do we use the information we collect when you visit the Gallery and what is our legal basis for processing it?
We will only process your information if we have a legal basis for doing so under current UK data protection legislation including:
- Where processing your information is necessary for our legitimate interests, including:
- For processing donations made when you visit the Gallery;
- Where we collect and view images recorded on our CCTV cameras, which we use only for security reasons to help us keep our visitors, staff, and collection safe;
- Where we collect MAC (media access control) addresses for the purposes of monitoring and analysing the usage of and maintaining our free public Wi-Fi service, and also analysing (in an aggregated and anonymous format) visitor movements around the Gallery to improve our visitor experience; or
- Where (from time to time) we (or a third party) carry out any filming, including interviews or filming/photographing of talks or events in the Gallery. Where particular areas of the Gallery are going to be used for filming or photography, we will always flag this in advance with clear signage or otherwise make you aware of the filming in advance, so that you can avoid being filmed or photographed.
Where we are relying on the legitimate interest basis for processing data, you have the right to object to this. See our General privacy information for further details.
- Where we have your consent to process your information, for example:
- If you choose to leave a comment or query on one of our feedback forms you may include your contact details if you wish to receive a reply from the Gallery; we aim to respond within 10 working days, after which we will delete your personal data;
- Following our courses and events we ask for feedback in order to assess and improve our services; and
- From time to time we may undertake surveys of our visitors or invite visitors to participate in research projects in order to improve our services.
��Where you have given consent to the processing of your data you may withdraw it at any time [See link to your rights in side link: General privacy information].Where you have given consent to the processing of your data you may withdraw it at any time [See link to your rights in side link: General privacy information].
Where you have given consent to the processing of your data you may withdraw it at any time. See our General privacy information for further details.
- As a public authority we may also process your personal data where it is necessary for the performance of our Public Task.
- We may process special category data (for example, health data) on the basis of additional grounds, including where it is necessary to protect an individual's vital interests (for example, where you have a life-threatening accident or illness while visiting the Gallery and we have to process your personal data in order to make sure you receive appropriate medical attention). There may be situations where we process special category data with your explicit consent, such as when you tell us you need to book a disabled parking space.
What other organisations do we share your information with?
We will not sell your personal information to any third parties or external organisations.
Sharing your information with the National Gallery Company Ltd.
We share information with the National Gallery Company Ltd., which runs the shops in the Gallery, and oversees the running of the cafes and restaurants in the Gallery and the sale of audio guides in the Gallery. Complaints and feedback we receive about the shops, restaurants, cafes, and audio guides may be shared with the Company and in the event of a security incident taking place in a shop, cafe, or restaurant, or at a venue hire event which is run by the Company, CCTV footage may be shared with the Company.
Sharing your information with our service providers/external data processors
We may share some of your personal information with our service providers/data processors who include Securitas, which provides security and visitor services within the Gallery; we share CCTV footage, and other information about security incidents in the Gallery, with Securitas; Securitas processes information enquiries (including requests to use the Gallery’s disabled parking space) received in the Gallery on our behalf; Securitas provides trained first-aiders in the Gallery, who record details of any accidents within the Gallery if they are called to assist; Securitas sells Memberships and exhibition tickets on desks in the Gallery and records on our behalf personal data of those making these purchases; Securitas processes comments and complaints submitted to the Gallery and responds to these on our behalf and in liaison with us.
Our third party Wi-Fi infrastructure provider collects and processes MAC addresses and information regarding usage of our Wi-Fi service on our behalf.
Any such service providers are acting as our data processors and the contracts we enter into with them require them to comply with UK data protection laws, to process only for the purposes we specify, and to make sure they have the appropriate controls in place to protect the security of your information.
Sharing CCTV footage and Wi-Fi usage data
CCTV footage and Wi-Fi usage data (including MAC addresses) may, in the event of a security incident, be shared with the police and/or local authorities where it is lawful and appropriate to do so, in accordance with our legitimate interests outlined above.
How long do we keep information we collect on your visit to the Gallery for?
- We normally retain CCTV footage for 30 days, although in the event of a security incident or accident which may give rise to an insurance claim, which is captured on CCTV, it may be retained longer; and
- If you choose to leave a comment or query on one of our feedback forms and ask to receive a reply from the Gallery, we aim to respond within 10 working days, after which we will delete your personal data.