Skip to main content

Privacy policy: What this means for your visit to the Gallery

This section contains information which relates specifically to your visit the Gallery. Visitors to the Gallery should also see our General privacy information.

When you book tickets for a visit to the Gallery (subject to our Ticketing Terms) will set up an account with us to facilitate your booking and we shall collect the following information from you:

  • your name;
  • your email address;
  • your telephone number;
  • your address;
  • a Gift Aid Declaration (if applicable);
  • your marketing preferences;
  • a password for your account (although we will not be able to see this); and
  • your credit card or other payment information given in relation to payments for Tickets or donations made at the Gallery (although this information is not handled by us but a third party payment processor).

The personal data we collect on your visit may include:

  • your name and contact details given in relation to your comments, queries, feedback, or responses to surveys conducted while you are at the Gallery;
  • To meet the requirements of the NHS Test and Trace scheme (or similar) we collect the name and contact details of the lead booker of your party through our ticketing system along with the date and time of your visit. This information shall be recorded on our ticketing system whether you book your tickets online, on the phone, or by email.
  • credit card or other payment information given in relation to donations made at the Gallery;
  • images of you recorded on our CCTV cameras;
  • images captured on film or photography taken in the Gallery; and
  • MAC (Media Access Control) addresses of any device(s) you bring with you to the Gallery, whether or not you have connected to the Gallery’s free public Wi-Fi service. MAC addresses are identifiers which any Wi-Fi enabled device transmits whilst searching for a Wi-Fi connection. 

We will only process your information if we have a legal basis for doing so under current UK data protection legislation including:

  • Where processing your information is necessary for our legitimate interests, including:
    • For processing donations made when you visit the Gallery;
    • to combine information we hold about you to better understand your interests and preferences so that we can target communications we send to you in line with the information contained in this Privacy Policy (including in particular, your marketing preferences);
    • to conduct analysis and research in relation to our visitors, classify our visitors and audience into groups or segments by attitudes and behaviours, using the information you provide us with (through your interactions with us and our Gallery). These segments help us to understand our audience better and ensure we’re sending relevant information to each group and enable us to tailor and target our programme and services to help us manage and improve them;
    • to collect and view images recorded on our CCTV cameras, which we use only for security reasons to help us keep our visitors, staff, and collection safe;
    • to collect MAC (media access control) addresses for the purposes of monitoring and analysing the usage of and maintaining our free public Wi-Fi service, and also analysing (in an aggregated and anonymous format) visitor movements around the Gallery to improve our visitor experience; or
    • to (from time to time) we (or a third party) carry out any filming, including interviews or filming/photographing of talks or events in the Gallery. Where particular areas of the Gallery are going to be used for filming or photography, we will always flag this in advance with clear signage or otherwise make you aware of the filming in advance, so that you can avoid being filmed or photographed;
    • subject to any objection from you to marketing by post and the Mail Preference Service (‘MPS’), to send marketing materials to you by post;
    • to invite visitors to take part in surveys, to improve the Gallery’s visitor experience and product offering; and
    • to retain your personal information on our secure customer relationship management system for the above purposes.

Where we are relying on the legitimate interest basis for processing data, you have the right to object to this. See our General privacy information section “What rights to you have in relation to your personal information” for further details on how you can use these rights.

  • Processing your information because it is necessary for the performance of a contract with you or in order to take steps at your request prior to entering into a contract, including:
    • to process your booking, including any payment, of Tickets;
    • to confirm the completion of Ticket bookings and to provide you with your Ticket;
    • to confirm your identity for entry to the National Gallery (and/or any Exhibition or Event) at the time allotted by your Ticket;
    • to arrange collection of pre-ordered merchandise when you visit, if you purchased any when making booking your Ticket;
    • to provide you with information which is relevant to your visit and your Ticket including information about the Gallery and our collection applicable to your visit, which services will be available on the day of your visit, what health and safety restrictions may be in place in relation to your visit and expectations in relation to your conduct during your visit (in particular in relation to the coronavirus pandemic) and to bring your attention to any cancellation or closure of all or part of the Gallery whether planned or in an emergency; and
    • retain your personal information on our secure customer relationship management system for the above purposes.
  • Where we have your consent to process your information, for example:
    • If you choose to leave a comment or query on one of our feedback forms you may include your contact details if you wish to receive a reply from the Gallery; we aim to respond within 10 working days, after which we will delete your personal data;
    • Following our courses and events we ask for feedback in order to assess and improve our services; and
    • From time to time we may undertake surveys of our visitors or invite visitors to participate in research projects in order to improve our services.

Where you have given consent to the processing of your data you may withdraw it at any time. See our General privacy information section “What rights to you have in relation to your personal information” for further details.

  • When we have a legal obligation to do so: In appropriate circumstances we shall use your information to fulfil our legal obligations which may include:
    • complying with Health and Safety legislation in relation to the Coronavirus Pandemic, as required to from time to time. This shall include managing capacity of the Gallery and to analyse attendance and no-show rates and to inform capacity management;
    • complying with the Health and Safety implications if appropriate, for example reporting first aid incidents;
    • the use of CCTV recording equipment on our premises for monitoring and security purposes;
    • detecting and reducing the risk of fraudulent transactions in person or online, including the use of robots or bots in contravention of our Ticketing Terms
    • undertaking due diligence to detect fraud, money laundering and credit risk and protecting the reputation of the National Gallery;
    • to keep our databases up to date;
    • for our financial records, including for Gift Aid purposes;
    • such other obligations as are imposed on us from time to time;
    • deleting or updating the information we hold about you if we learn such information is inaccurate; and
    • complying with your data rights (as further described in our General Privacy Policy section “What rights to you have in relation to your personal information”)
  • As a public authority we may also process your personal data where it is necessary for the performance of our Public Task.

COVID-19: NHS Test and Trace

The National Gallery is required by law (under the Health Protection (Coronavirus, Collect of Contact Details etc. and Related Requirements) Regulations 2020) to comply with the NHS Test and Trace scheme. This means we may collect, store and then share some of your personal data we hold with NHS Test and Trace if we are requested to do so.

If you arrange to visit the Gallery, if you are visiting on your own, we will use the personal data you provide as part of your ticket booking to meet the requirements of NHS Test and Trace. If you are visiting in a group of two or more we will use the details of the lead ticket booker to meet the requirements of NHS Test and Trace. Other members of your party who are over 16 are invited to provide the data required for NHS Test and Trace or ask them to use the NHS Test and Trace app (by scanning the NHS QR code) upon arrival at the Gallery.

Please see the section below for details of how and when we share your personal data and how you may opt out of the NHS Test and Trace. For further information on how the NHS processes your personal data once it has been collected please see the NHS Test and Trace Privacy Notice.

If you are visiting the Gallery as a guest to an event, a contractor or in another capacity we shall request your data is provided by you personally on or before your arrival for the purposes of complying with NHS Test and Trace.

In order comply with NHS Test and Trace we collect and share the following personal data: - Your name; - Your contact details (either your telephone number or email address); and - The data and time of your visit to the National Gallery.

We shall only collect and share for this purpose personal data of persons aged 16 and over in accordance with the NHS Test and Trace guidance.

Any processing in relation to NHS Test and Trace scheme shall be undertaken on the legal basis that it is the performance of a task carried out in the public interest. This shall include the collection of such data, its storage and its sharing if required under the NHS Test and Trace scheme.

Please note that this information may be subject to further updates where necessary to comply with any new guidance on NHS Test and Trace issued by the Department of Health and Social Care.


Special Category Data (for example, data about your health). We may process special category data on the basis of additional grounds, including where it is necessary to protect an individual's vital interests (for example, where you have a life-threatening accident or illness while visiting the Gallery and we have to process your personal data in order to make sure you receive appropriate medical attention). There may be situations where we process special category data with your explicit consent, such as when you tell us you need to book a disabled parking space.

If you purchase your tickets online, you shall have the opportunity to sign up as an email or text subscriber to receive marketing communications in relation to the National Gallery. This processing is described by this section of our Privacy Policy “What this means for our subscribers”.

If you elect to give a donation to the Gallery Gift Aid, our use of the information you provide as part of any Gift Aid Declaration is described in our General Privacy information.

We will not sell your personal information to any third parties or external organisations.

Sharing your information with the National Gallery Company Ltd.

We share information with the National Gallery Company Ltd., which runs the shops in the Gallery, and oversees the running of the cafes and restaurants in the Gallery.

Complaints and feedback we receive about the shops, restaurants and cafes may be shared with the Company and in the event of a security incident taking place in a shop, cafe, or restaurant, or at a venue hire event which is run by the Company, CCTV footage may be shared with the Company.

We shall also share information about you with the National Gallery Company Limited when you have made online purchases for collection on your arrival at the Gallery, for example, if you have purchased a guide book.

Sharing your personal data with such persons under the NHS Test and Trace Scheme

Sharing your personal data with such persons under the NHS Test and Trace Scheme

We will only share your personal data under the NHS Test and Trace Scheme if a request is received from a legitimate public health authority within 21 days following your visit (and you have not opted out). This will happen only where it is necessary either because someone who has tested positive for COVID-19 has listed our premises as a place they recently visited or because we have been identified as a location of a potential outbreak of COVID-19.

NHS Test and Trace have assured us that it shall handle all data according to the highest ethical and security standards and shall ensure it is used only for the purposes of protecting public health including minimising the transmission of COVID-19. Data is processed under the NHS Test and Trace scheme in accordance with the NHS Test and Trace Privacy Notice.

If you do not want your details shared for the purposes of NHS Test and Trace, you can choose to opt out by emailing dataprotection@ng-london.org.uk, and the information you have used for booking purposes will not be shared with NHS Test and Trace. Please send such requests as soon as possible including your name and the date and time of your visit to the Gallery. Such preference will be stored for a period of 21-28 days after your visit before it is deleted.

If you are booking tickets on arrival at the Gallery, you may exercise your right to opt out by informing the member of staff concerned that you do not wish to provide your Test and Trace data.

The right to opt out of NHS Test and Trace is in addition to your legal rights over the use of your personal data which are set out in the Gallery’s privacy policy.

Sharing your information with our service providers/external data processors

We may share some of your personal information with our service providers/data processors who include Securitas, which provides security and visitor services within the Gallery; we share your personal information sufficient to facilitate your entry into the Gallery and the use of your Tickets; we share CCTV footage, and other information about security incidents in the Gallery, with Securitas; Securitas processes information enquiries (including requests to use the Gallery’s disabled parking space) received in the Gallery on our behalf; Securitas provides trained first-aiders in the Gallery, who record details of any accidents within the Gallery if they are called to assist; Securitas sells Memberships and exhibition tickets on desks in the Gallery and records on our behalf personal data of those making these purchases; Securitas processes comments and complaints submitted to the Gallery and responds to these on our behalf and in liaison with us.

Our third party Wi-Fi infrastructure provider collects and processes MAC addresses and information regarding usage of our Wi-Fi service on our behalf.

Any such service providers are acting as our data processors and the contracts we enter into with them require them to comply with UK data protection laws, to process only for the purposes we specify, and to make sure they have the appropriate controls in place to protect the security of your information.

Sharing CCTV footage and Wi-Fi usage data

CCTV footage and Wi-Fi usage data (including MAC addresses) may, in the event of a security incident, be shared with the police and/or local authorities where it is lawful and appropriate to do so, in accordance with our legitimate interests outlined above.

We will keep your information for as long as is necessary for the purposes set out in this privacy policy. The retention period will vary according to the nature of the purpose for which we hold the information. For example:

  • We normally retain CCTV footage for 30 days, although in the event of a security incident or accident which may give rise to an insurance claim, which is captured on CCTV, it may be retained longer; and
  • Any information collected solely in relation to the NHS Test and Trace scheme shall be retained for between 21 and 28 days after your visit before it is permanently deleted;
  • If you choose to leave a comment or query on one of our feedback forms and ask to receive a reply from the Gallery, we aim to respond within 10 working days, after which we will delete your personal data.
  • We will otherwise keep your personal information as long as necessary for the legal purposes set out above.