If you would like to know more about the General Data Protection Regulation (GDPR) (EU) 2016/679 and what this means for you, then click here.
The Whitechapel Gallery was founded in 1901. Its aim is to bring modern and contemporary art and ideas to local, national and international audiences and to promote free-thinking, creativity and learning. With solo and survey exhibitions, artist commissions, collection displays, historic archives, education resources, art courses, Cafe/Bar and Bookshop, the Gallery is open all year round, so there is always something free to see.
The Whitechapel Gallery is a registered charity. Registered Charity Number 312162. The Gallery receives funding from the Arts Council of England and income secured through commercial, fundraising, sponsored and charging activities.
The official address of the Whitechapel Gallery and all its companies is 77 – 82 Whitechapel High Street, London, E1 7QX.
When we talk about “you” or “your” in this policy we mean any living person whose personal data we collect.
When we talk about “Members” and “Membership” we are referring to subscribing members of the Whitechapel Gallery Membership.
The definition of “personal data” is information that identifies a living person, or which can be identified as relating to a living person.
We hold the following categories of personal data:
2.1. Personal data you provide
We collect data you provide to us. This includes information you give when you communicate with us, apply for membership, purchase tickets, products or services, sign up to receive communications from us, make a donation, apply for employment, volunteer or enter into a contract with us. For example we may hold:
If you purchase Gallery membership as a gift for someone your details will be recorded (as will the recipient’s) and your relationship to that person will be recorded.
2.2. Personal data generated by your involvement with the Gallery
Your activities and involvement with the Gallery will result in personal data being generated. This could include:
2.3. Personal data from third parties
We sometimes receive personal data about you from third parties, for example, if we are partnering with another organisation or where we may use third parties to help us conduct research and analysis about you to determine the success of our public offer and to help us provide you with a better experience (and this can result in new personal data being created).
We may collect information from social media about you, or if you post on any of our social media pages.
Occasionally, we may collect personal data about you (for example if you are particularly well known or influential) from the media and other publicly available sources. This may come from public databases (such as Companies House), news or other media. The sort of information we obtain from these sources might include details of other charities you may support and indicators of your leisure interests and financial status such as house value or post code.
2.4. Special category (‘sensitive’) personal data
We do not normally collect or store special categories of personal data. However there are some situations where we may need to do so. These may include, for example, if you work or volunteer with us or apply to do so, or if we need to know about any access, medical or dietary requirements you, or someone in your care, may have.
3.1. General use
We only ever use your personal data with your consent, or where it is necessary in order to:
We will only use your personal data for the purpose or purposes for which it was obtained.
We use your personal data to communicate with you in order to promote our activities and events and to help with fundraising. This includes keeping you up to date with our exhibitions, events and products in our shops, and to send you general information about fundraising, membership and other ways you may be able to support us at the Whitechapel Gallery.
We use your personal data for administrative purposes including:
3.4. Internal research and profiling
We carry out research and analysis on our visitors, Members and other supporters to determine the success of our public offer and programmes and other activities in the public interest and to help us provide you with a better experience (for example so that you only receive communications about areas of our activities or research you are mostly likely to be interested in).
We may evaluate, categorise and profile your personal data in order to tailor materials, services and communications (including targeted advertising) to your needs and your preferences and to help us to understand our audiences. For example, we may keep track of the amount, frequency and value of your support including your philanthropic involvement elsewhere. This information helps us to ensure communications are relevant, timely and in the best interest of our charitable purposes.
We will never sell your personal data.
If you have opted-in to marketing, we may contact you with information about our selected partners. These communications will always come from us and will usually be incorporated into our own marketing.
We may share your personal data with contractors or suppliers who provide us with services. For example, we may use a mailing house for the distribution of Whitechapel Gallery’s Season Guide and Season Opening Invitations; we use Direct Debit processors for the handling of payments and email providers for our marketing communications. Information is transferred to data processors securely, and we retain full responsibility for your personal data as the data controller. These activities are carried out under a contract which imposes strict requirements on our suppliers to keep your personal data confidential and secure.
Occasionally we share data when we arrange events with other organisations, for example when you register to attend events. We will only share information when necessary.
We may share your personal data where required to do so for prevention of crime or for taxation purposes (for example, with the police, HMRC) or where otherwise required to do so by other regulators or by law (e.g. the Charity Commission, Companies House).
Unless you have already given us your email address or telephone number so that we can tell you about making donations to us or about the supply of goods and services, we must ask you to “opt-in” to receive fundraising and marketing emails from us. You have the choice as to whether you want to receive or continue to receive these messages. You are able to change your preferences at any time.
When you receive a communication from us, we may collect information about your response and this may affect how we communicate with you in future.
5.2. Newsletters and magazines
If you are a Member or a Patron, we will send you the Whitechapel Gallery Season Guide (unless you specifically ask us not to) and you can choose to unsubscribe from general marketing communications to Members without cancelling your subscription to the Season Guide.
6.1. Information for parents and guardians
We take great care to protect and respect the rights of individuals in relation to their personal data, especially in the case of those aged 13 or younger.
The Gallery’s Education events are regularly photographed for documentation purposes and selected images are used for Marketing. This is always done with consent at the time of the event.
We employ a variety of physical and technical measures detailed in an IT Security Policy to protect information we hold and to prevent unauthorised access to, or use or disclosure of your personal data.
Electronic data and databases are stored on secure computer systems and we control who has access to information (using both physical and electronic means). Staff receive data protection training and we maintain a set of data protection procedures which our staff are required to follow when handling personal data.
7.2. Payment security
All payments to the Whitechapel Gallery are securely processed following our IT Security Policy.
The Whitechapel Gallery’s premises are protected by CCTV and you may be recorded when you visit. We use CCTV to help provide a safe and secure environment for visitors, for our staff, and to prevent or detect crime.
The system is managed in accordance with our standard operating procedures and with good practice guidance issued by the Information Commissioner’s Office. CCTV images will only be accessed by authorised security staff and are stored for up to 30 days, unless flagged for review.
9.1. Where we store data
We are wholly based in the UK and store data within the European Economic Area. Some organisations which provide data processing services to us do so under contract and may be based outside of the EEA. We will only allow them to do so if your data is adequately protected.
9.2. Retention of your personal data
We will only retain your personal data for as long as it is required for the purposes for which we collected it (e.g. we have a genuine and legitimate reason and we’re not harming any of your rights and interests).This will depend on our legal obligations and the nature and type of information and the reason for which we collected it. For example, should you ask us not to send you marketing emails, we will stop storing your email address for marketing purposes; however we may keep a record of your preference.
We continually review what information we hold and will delete personal data which is no longer required.
10.1. Your rights
We want to ensure you remain in control of your personal data and that you understand your legal rights, which are:
There are some exceptions to the rights above and, although we will always try to respond to any instructions you may give us about our handling of your personal information, there may be situations where we are unable to meet your requirements in full.
Should you wish to make a subject access request, we can provide you with a template form which includes guidance on how to do this. Please contact us for a copy of the template for a subject access request by emailing: email@example.com
Please also use this address if you would like to request for your data to be erased.
Should you have a complaint about how we have used (‘processed’) your personal data, you can complain to us directly by emailing firstname.lastname@example.org
If you are not happy with our response, or you believe that your data protection or privacy rights have been infringed, you can complain to the UK Information Commissioner’s Office which regulates and enforces data protection law in the UK. Details of how to do this can be found at https://ico.org.uk/for-the-public/
Our websites use local storage (such as cookies) in order to provide you with the best possible experience and to allow you to make use of certain functionality (such as being able to shop online).
Our websites contain links to other external websites. We are not responsible for the content or functionality of any such websites. Please let us know if a link is not working by contacting email@example.com
We realise that you may have specific questions about what happens to your personal data during your interaction with the Whitechapel Gallery.
The personal data you provide in order to apply for a job is stored in a restricted access filing system and used for the purposes of shortlisting and interviewing. The information will be deleted six months after the deadline for that job. The legal basis for this is to fulfil a contract .
The personal data you provide in this transaction is stored in our secure in-house database Raiser’s Edge, with our online mailing partner, Mailchimp and postal mailing partner TMB International. The legal basis for this is to fulfil a contract , meaning to provide you with the benefits purchased with membership. The Whitechapel Gallery keeps your data for an unlimited period unless you cancel your membership. You have the right to withdraw your consent and sign-up to the e-newsletters by unsubscribing, with opt-out offered in each email.
We store the personal data you provide in this transaction within our secure in-house ticketing system, Merac. The legal basis for this is to fulfil a contract, meaning to ensure that you receive the correct access to a Gallery event or programme. To fulfil a public task, the Gallery collates anonymous data from this transaction, such as your ticket selection type and date of visit, to report on audiences to our primary funder, The Arts Council England. We will store your data to ensure that we continue to provide you with a high-quality service, using legitimate interest as a legal basis. With your consent we will email you regarding future activities.Your personal data will not be shared further by the Whitechapel Gallery.
We store the personal data you provide in this transaction within our secure in-house payment system supplied by Shopify which is connected to Sagepay. The transaction is accessible with password protection to the Gallery’s Commercial and Marketing staff. The legal basis for this is to fulfil a contract, meaning to ensure that you correctly receive the product you have purchased. We will use your data to ensure that we continue to provide a high-quality service, for business development and sales analysis, using legitimate interest as a legal basis. With your consent we will email you regarding special Editions and Publications promotions.Your personal data will not be shared further by the Whitechapel Gallery.
We store the personal data you provide in this transaction within our secure in-house ticketing system provided by Merac, accessible with password protection to a limited number of Gallery Visitor Services staff. The legal basis for this is to fulfil a contract, meaning to ensure that you receive the correct access to a Gallery event or programme. It is also to fulfil a public task, since the Gallery collates anonymous data from this transaction, such as your ticket selection type and date of visit, to report on audiences to our primary funder, The Arts Council England. We will store your data to ensure that we continue to provide you with a high-quality service, using legitimate interest as a legal basis. With your consent we will email you regarding future activities.Your personal data will not be shared further by the Whitechapel Gallery.
Responses to questions collated by The Audience Agency are all anonymous. If you choose to share your email address and sign-up to the Gallery’s e-newsletters, the personal data you provide in this transaction is stored with our secure online mailing partner, Mailchimp. The legal basis for this data storage is consent, which you provide by completing Mailchimp’s two-step opt-in process. Once this is completed, your personal data is accessible to a limited number of Gallery Marketing staff responsible for e-newsletters, is password-protected, and will not be shared further by the Whitechapel Gallery. You have the right to withdraw your consent and sign-up to the e-newsletters by unsubscribing, with opt-out offered in each email. The Whitechapel Gallery keeps your data for an unlimited period unless you unsubscribe.
The personal data that you provide when donating material to the Archive is stored in the secure Archive. The legal basis for this is Archiving in the public interest.
We will ask your consent for the records to be public, but if you do not agree (or withdraw your consent) then the donations will be closed to public access for 100 years.
When requesting access to the Archive, the data you provide enables Archive staff to carry out the public service you have requested. Electronic versions of this form are stored in a restricted access database, consulted only by the Archivist. Paper versions are filed in a securely locked archive repository accessed only by Archives staff. The legal basis of holding this enquiry data is fulfil a contract. Paper forms are stored for ten years. Digital versions are held in perpetuity.
We store the personal data you provide when booking a space within our secure in-house system. Data is accessible via password protection to the Gallery’s Venue Hire staff. The legal basis for this is to fulfil a contract, to ensure that you correctly receive the product you have purchased. We will use your data to ensure that we continue to provide a high-quality service, for business development and sales analysis, using legitimate interest as a legal basis. With your consent we will email you regarding special Venue Hire promotions.Your personal data will not be shared by the Whitechapel Gallery.
The personal data provided in any agreement concerned with Exhibitions is stored within our secure in-house database, Raiser’s Edge, and by Gallery Exhibitions and Archive staff in locked files with restricted access. The legal basis for this includes to fulfil a contract and Archiving purposes for the public interest. Files are referenced by our Gallery Development staff on the basis of legitimate interest and kept for an unlimited period.
The personal data you provide for use with invoices, purchase orders, gift aid forms, expenses forms, freelancer forms and other financial purposes is used in order for the Gallery to claim payment for goods and services or to pay for such goods and services. The data is stored in a secure system and kept for kept for six years in line with standard financial practice. The legal basis for this is to fulfil a contract.
If you choose to sign-up to the Gallery’s e-newsletters, we store the personal data you provide in this transaction. The legal basis for this data storage is consent, which you provide by completing our online mailing partner, Mailchimp’s, two-step opt-in process. Once this is completed, your personal data is accessible to a limited number of Gallery Marketing staff responsible for e-newsletters, is password-protected, and will not be shared further by the Whitechapel Gallery. You have the right to withdraw your consent and sign-up to the e-newsletters by unsubscribing, with opt-out offered in each email. The Whitechapel Gallery keeps your data for an unlimited period unless you unsubscribe.
The personal data you provide in order to become employed by the Gallery (and during your employment) includes special category data such as health records. It is stored in a restricted access filing system. It is used for the purpose of administration, management and compliance with applicable laws and regulations. The information will be held for as long as you are employed and for 6 years afterwards. The legal basis for this is as a legal obligation, to fulfil a contract and legitimate interest.
If you have further questions, please contact firstname.lastname@example.org