This section contains information which relates specifically to your visit the Gallery. Visitors to the Gallery should also see our General privacy information.
What information do we collect when you visit the Gallery and how do we collect it?
When you book tickets for a visit to the Gallery (subject to our Ticketing Terms) will set up an account with us to facilitate your booking and we shall collect the following information from you:
- your name;
- your email address;
- your telephone number;
- your address;
- a Gift Aid Declaration (if applicable);
- your marketing preferences;
- a password for your account (although we will not be able to see this); and
- your credit card or other payment information given in relation to payments for Tickets or donations made at the Gallery (although this information is not handled by us but a third party payment processor).
The personal data we collect on your visit may include:
- your name and contact details given in relation to your comments, queries, feedback, or responses to surveys conducted while you are at the Gallery;
- To meet the requirements of the NHS Test and Trace scheme (or similar) we collect the name and contact details of the lead booker of your party through our ticketing system along with the date and time of your visit. This information shall be recorded on our ticketing system whether you book your tickets online, on the phone, or by email.
- credit card or other payment information given in relation to donations made at the Gallery;
- images of you recorded on our CCTV cameras;
- images captured on film or photography taken in the Gallery; and
- MAC (Media Access Control) addresses of any device(s) you bring with you to the Gallery, whether or not you have connected to the Gallery’s free public Wi-Fi service. MAC addresses are identifiers which any Wi-Fi enabled device transmits whilst searching for a Wi-Fi connection.
How do we use the information we collect when you visit the Gallery and what is our legal basis for processing it?
We will only process your information if we have a legal basis for doing so under current UK data protection legislation including:
- Where processing your information is necessary for our legitimate interests, including:
- For processing donations made when you visit the Gallery;
- to conduct analysis and research in relation to our visitors, classify our visitors and audience into groups or segments by attitudes and behaviours, using the information you provide us with (through your interactions with us and our Gallery). These segments help us to understand our audience better and ensure we’re sending relevant information to each group and enable us to tailor and target our programme and services to help us manage and improve them;
- to collect and view images recorded on our CCTV cameras, which we use only for security reasons to help us keep our visitors, staff, and collection safe;
- to collect MAC (media access control) addresses for the purposes of monitoring and analysing the usage of and maintaining our free public Wi-Fi service, and also analysing (in an aggregated and anonymous format) visitor movements around the Gallery to improve our visitor experience; or
- to (from time to time) we (or a third party) carry out any filming, including interviews or filming/photographing of talks or events in the Gallery. Where particular areas of the Gallery are going to be used for filming or photography, we will always flag this in advance with clear signage or otherwise make you aware of the filming in advance, so that you can avoid being filmed or photographed;
- subject to any objection from you to marketing by post and the Mail Preference Service (‘MPS’), to send marketing materials to you by post;
- to invite visitors to take part in surveys, to improve the Gallery’s visitor experience and product offering; and
- to retain your personal information on our secure customer relationship management system for the above purposes.
Where we are relying on the legitimate interest basis for processing data, you have the right to object to this. See our General privacy information section “What rights to you have in relation to your personal information” for further details on how you can use these rights.
- Processing your information because it is necessary for the performance of a contract with you or in order to take steps at your request prior to entering into a contract, including:
- to process your booking, including any payment, of Tickets;
- to confirm the completion of Ticket bookings and to provide you with your Ticket;
- to confirm your identity for entry to the National Gallery (and/or any Exhibition or Event) at the time allotted by your Ticket;
- to arrange collection of pre-ordered merchandise when you visit, if you purchased any when making booking your Ticket;
- to provide you with information which is relevant to your visit and your Ticket including information about the Gallery and our collection applicable to your visit, which services will be available on the day of your visit, what health and safety restrictions may be in place in relation to your visit and expectations in relation to your conduct during your visit (in particular in relation to the coronavirus pandemic) and to bring your attention to any cancellation or closure of all or part of the Gallery whether planned or in an emergency; and
- retain your personal information on our secure customer relationship management system for the above purposes.
- Where we have your consent to process your information, for example:
- If you choose to leave a comment or query on one of our feedback forms you may include your contact details if you wish to receive a reply from the Gallery; we aim to respond within 10 working days, after which we will delete your personal data;
- Following our courses and events we ask for feedback in order to assess and improve our services; and
- From time to time we may undertake surveys of our visitors or invite visitors to participate in research projects in order to improve our services.
Where you have given consent to the processing of your data you may withdraw it at any time. See our General privacy information section “What rights to you have in relation to your personal information” for further details.
- When we have a legal obligation to do so: In appropriate circumstances we shall use your information to fulfil our legal obligations which may include:
- complying with Health and Safety legislation in relation to the Coronavirus Pandemic, as required to from time to time. This shall include managing capacity of the Gallery and to analyse attendance and no-show rates and to inform capacity management;
- complying with the Health and Safety implications if appropriate, for example reporting first aid incidents;
- the use of CCTV recording equipment on our premises for monitoring and security purposes;
- detecting and reducing the risk of fraudulent transactions in person or online, including the use of robots or bots in contravention of our Ticketing Terms
- undertaking due diligence to detect fraud, money laundering and credit risk and protecting the reputation of the National Gallery;
- to keep our databases up to date;
- for our financial records, including for Gift Aid purposes;
- such other obligations as are imposed on us from time to time;
- deleting or updating the information we hold about you if we learn such information is inaccurate; and
- As a public authority we may also process your personal data where it is necessary for the performance of our Public Task.
- Any processing in relation to the NHS Test and Trace scheme shall be undertaken on the legal basis that it is the performance of a task carried out in the public interest. This shall include the collection of such data, its storage and its sharing if required under the NHS Test and Trace scheme;
- We may process special category data (for example, health data) on the basis of additional grounds, including where it is necessary to protect an individual's vital interests (for example, where you have a life-threatening accident or illness while visiting the Gallery and we have to process your personal data in order to make sure you receive appropriate medical attention). There may be situations where we process special category data with your explicit consent, such as when you tell us you need to book a disabled parking space.
If you elect to give a donation to the Gallery Gift Aid, our use of the information you provide as part of any Gift Aid Declaration is described in our General Privacy information.
What other organisations do we share your information with?
We will not sell your personal information to any third parties or external organisations.
Sharing your information with the National Gallery Company Ltd.
We share information with the National Gallery Company Ltd., which runs the shops in the Gallery, and oversees the running of the cafes and restaurants in the Gallery.
Complaints and feedback we receive about the shops, restaurants and cafes may be shared with the Company and in the event of a security incident taking place in a shop, cafe, or restaurant, or at a venue hire event which is run by the Company, CCTV footage may be shared with the Company.
We shall also share information about you with the National Gallery Company Limited when you have made online purchases for collection on your arrival at the Gallery, for example, if you have purchased a guide book.
Sharing your personal data with such persons under the NHS Test and Trace Scheme
If we are required to do under the NHS Test and Trace Scheme, we shall share the details required by this scheme with legitimate public health authorities. This will happen only where it is necessary either because someone who has tested positive for COVID-19 has listed our premises as a place they recently visited or because we have been identified as a location of a potential outbreak of COVID-19. NHS Test and Trace have assured us that it shall handle all data according to the highest ethical and security standards and shall ensure it is used only for the purposes of protecting public health including minimising the transmission of COVID-19. If you do not want your details shared for the purposes of NHS Test and Trace, you can choose to opt out by emailing email@example.com, and the information you have used for booking purposes will not be shared with NHS Test and Trace.
Sharing your information with our service providers/external data processors
We may share some of your personal information with our service providers/data processors who include Securitas, which provides security and visitor services within the Gallery; we share your personal information sufficient to facilitate your entry into the Gallery and the use of your Tickets; we share CCTV footage, and other information about security incidents in the Gallery, with Securitas; Securitas processes information enquiries (including requests to use the Gallery’s disabled parking space) received in the Gallery on our behalf; Securitas provides trained first-aiders in the Gallery, who record details of any accidents within the Gallery if they are called to assist; Securitas sells Memberships and exhibition tickets on desks in the Gallery and records on our behalf personal data of those making these purchases; Securitas processes comments and complaints submitted to the Gallery and responds to these on our behalf and in liaison with us.
Our third party Wi-Fi infrastructure provider collects and processes MAC addresses and information regarding usage of our Wi-Fi service on our behalf.
Any such service providers are acting as our data processors and the contracts we enter into with them require them to comply with UK data protection laws, to process only for the purposes we specify, and to make sure they have the appropriate controls in place to protect the security of your information.
Sharing CCTV footage and Wi-Fi usage data
CCTV footage and Wi-Fi usage data (including MAC addresses) may, in the event of a security incident, be shared with the police and/or local authorities where it is lawful and appropriate to do so, in accordance with our legitimate interests outlined above.
How long do we keep information we collect on your visit to the Gallery for?
- We normally retain CCTV footage for 30 days, although in the event of a security incident or accident which may give rise to an insurance claim, which is captured on CCTV, it may be retained longer; and
- Any information collected solely in relation to the NHS Test and Trace scheme shall be retained for between 21 and 28 days after your visit before it is permanently deleted;
- If you choose to leave a comment or query on one of our feedback forms and ask to receive a reply from the Gallery, we aim to respond within 10 working days, after which we will delete your personal data.
- We will otherwise keep your personal information as long as necessary for the legal purposes set out above.