Privacy Notice

The National Portrait Gallery is committed to protecting your personal information. This Privacy Notice sets out which information is collected about you by the Gallery, how we use it and the choices and controls you have.

We will never sell, rent or exchange your details with any other organisation outside the National Portrait Gallery without your prior consent.

This Privacy Notice has been prepared to be as comprehensive as possible, but it does not include an exhaustive list of every aspect of our collection and use of personal information. However, we would be happy to provide any further information or explanation about our practices. If you have any general queries or concerns about this policy, please contact our Data Protection Officer at DPO@npg.org.uk.

Changes to this Privacy Notice

From time to time the Gallery will change this privacy notice. You may therefore wish to check this page each time you submit personal information to the Gallery. The latest privacy notice will always appear on this page.

This Privacy Notice was last updated in May 2018.

Please note, this Privacy Notice is currently under review and will be updated shortly.

Who we are

This Privacy Notice applies to the National Portrait Gallery, London (NPG). The Gallery was founded in 1856 to collect and display portraits of people who have contributed to British history and culture. Today the Gallery’s Collection is among the largest and most prestigious collections of portraits in the world. The Gallery is a Non-Departmental Public Body supported by the Department for Culture, Media and Sport (DCMS) and is an exempt charity under the Charities Act 2011. You can find out more about the functions the Gallery by reading our statement of public task here [link to https://www.npg.org.uk/about/corporate/gallery-policies/statement-of-public-task]

The National Portrait Gallery Company Limited (Company Number 06015724) is a wholly owned subsidiary of the Gallery, which was set up to generate income to help the Gallery meet its overall aims and objectives. 

The Gallery’s address is 2 St Martin’s Place, London, WC2H 0HE.

Under this notice, ‘we’, ‘NPG’ and ‘the Gallery’ refers to both the National Portrait Gallery and the National Portrait Gallery Company Limited.

Data Protection

The Gallery will only use your personal information in accordance with this Notice, its Data Protection Policy, and relevant data protection laws including the General Data Protection Regulation, Data Protection Act 2018 and any reiteration of relevant legislations. Our Data Protection registration number is Z5637141. Please see our Data Protection Policy here www.npg.org.uk/about/corporate/gallery-policies/data-protection-policy

Our legal bases for processing your data

Under data protection law, we need a lawful basis to collect and use your personal data. The law allows for six ways to process personal data. All of these are relevant to the types of processing that we carry out. This includes information that is processed on the basis of:

  1. a person’s consent (for example, if you consent to receive our e-newsletter)
  2. a contractual relationship (for example, to provide you with goods or services that you have purchased from us, such as a ticket or Membership)
  3. complying with a legal obligation (for example to process a Gift Aid declaration, or carrying out due diligence on large donations)
  4. the Gallery’s public functions as defined by DCMS (for example, in maintaining and providing access to our collections)
  5. protecting an individual’s vital interests (for example, to ensure the safety of staff and visitors to the Gallery)
  6. the legitimate interests of the Gallery, you as an individual, or wider benefits to society (please see below for more information)

Personal data may be legally collected and used if it is necessary for a legitimate interest of the organisation using the data, if its use is fair, and if it does not adversely impact the rights and freedoms of the individual concerned.

When we use your personal information, we will always consider if it is fair and balanced to do so and if it is within your reasonable expectations. We will balance your rights and our legitimate interests to ensure that we use your personal information responsibly and in ways that are not unduly intrusive or unfair.

If you would like more information on our use of legitimate interests, or to change our use of your personal data in this manner, please get in touch with us by contact our Data Protection Officer at DPO@npg.org.uk.

Your rights

We want to ensure you remain in control of your personal data and that you understand your legal rights, which are:

  • the right to know whether we hold your personal data and, if we do so, to be sent a copy of the personal data that we hold about you (a ‘Subject Access Request’/SAR) within one month;
  • the right to have inaccurate or incomplete personal data updated or amended;
  • the right to have your personal data erased (though this will not apply where it is necessary for us to continue to use the data for a lawful or legitimate reason); and
  • the right to object to your personal data being used for marketing or profiling.

There are some exceptions to the rights above and, although we will always try to respond to any instructions you give us about our handling of your personal information, there may be situations where we are unable to meet your requirements in full.

If you would like further information on your rights or wish to exercise them, please contact our Data Protection Officer (details below).

It is important that the information we hold about you is accurate, therefore please let us know of any changes to the personal information you give to us. Please also get in touch if you wish to know what personal information we hold about you or how we process your information. This is your right of access and is known as a Subject Access Request (SAR). To submit a SAR you can contact us by email at DPO@npg.org.uk, or write to us at Data Protection Officer, National Portrait Gallery, St Martin’s Place, London, WC2H 0HE. Please note you will be asked to provide proof of identification.

Questions and complaints

Should you have a question or complaint about how we have used (‘processed’) your personal data, you can contact us directly by contacting our Data Protection Officer in the first instance via email at DPO@npg.org.uk, or by writing to Data Protection Officer, National Portrait Gallery, St Martin’s Place, London, WC2H 0HE

If you are not happy with our response, or you believe that your data protection or privacy rights have been infringed, you can complain to the UK Information Commissioner’s Office (ICO) which regulates and enforces data protection law in the UK. Details of how to do this can be found at http://www.ico.org.uk

Disclosure of your information

We occasionally use third party data processors for the purpose of distributing communication materials (e.g. a mailing house). Where we do this, we will always ensure the third party organisation enters into a suitable data processing agreement to ensure your personal information will be processed in accordance with the General Data Protection Regulation and Data Protection Act 2018 and any reiteration of relevant legislations.

We will disclose your personal information to third parties if we are under a duty to disclose or share your personal data in order to comply with any legal obligation; or in order to enforce or apply our Terms and Conditions of Use and other agreements; or to protect the rights, property or safety of the Gallery, our customers or others. This includes exchanging information with other companies and organisations for the purposes of fraud protection.

External suppliers

In some cases we work with external suppliers to provide certain services. All data is transferred securely and all external suppliers have signed data processing and confidentiality agreements with the Gallery.

Storage of your information

The Gallery’s preference is that data we collect from you is stored in the UK/EU (European Union). Where your data is transferred and stored outside the UK/EU we will take all steps reasonably necessary to ensure that any data processor we use provides an adequate level of protection for your data. The transmission of information via the Internet, unfortunately, is not completely secure, and any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to help prevent unauthorised access.

Statistical Information

The Gallery will keep records of a statistical nature where personal data will be anonymised, in order to improve our provided services.

How to use this privacy notice

This notice is structured according to different ways you may interact with the Gallery. Please click on the headings below for further information.

Visitor to the Gallery

Photographs in the Gallery and at events

The Gallery reserves the right to take photographs in public and gallery spaces and at events. Individuals should notify staff if they do not wish to be photographed. All reasonable efforts will be made to gain approval (usually via a consent form) from the subject of any image of an identifiable person which the Gallery publishes in print or online. Parents/ Guardians will be asked to sign approval forms for children under 13 years old.

Ticket Purchase

We collect information about you when you purchase a ticket, book an event, create a user account or log into the ticketing section of our website.

We will keep your information for the necessary period to process your ticket purchase/s or event booking/s in accordance with our retention schedules and legal compliance. Find out more about our Records Management Policy here. Once your personal information is no longer required we will delete it from our records in a secure manner. Not all records can be deleted immediately; The Gallery has statutory, legal, business continuity and administrative requirements to hold on to certain records for specified periods.

Contacting the Gallery

If you contact us, make an enquiry, provide feedback or send us an e-mail or letter we will keep your information for a reasonable period in order to respond to you and take any necessary action. This is in accordance with our retention schedules and legal compliance (three months for standard enquiry). Find out more about our Records Management Policy here. Once your personal information is no longer required we will delete it from our records in a secure manner. Not all records can be deleted immediately; The Gallery has statutory, legal, business continuity and administrative requirements to hold on to certain records for specified periods.

Third Party Service Providers

Some onsite services are operated by third parties, and are governed by their own specific terms. Our privacy policy does not govern these third parties. We will not accept responsibility for third party applications or for any loss or damage arising from your use of them.

We use several third parties to process transactions onsite – please see details below:

Print on Demand and mobile PDQ machines by WorldPay http://www.worldpay.com/uk/privacy-policy

Framed print orders are fulfilled and transacted by our partner, King & McGaw https://www.kingandmcgaw.com/help/privacy

The payment solution for Membership, Patronage and ticketing card transactions is TNS https://www.tnsi.com/Privacy

Address verification through Experian https://www.edq.com/uk/privacy

Please note our Restaurant and Café are run by a third party, Company of Cooks (Public Restaurant Partner Ltd). When you book with the Portrait Restaurant or sign up to the Restaurant mailing list your data is being held and used by Company of Cooks http://www.companyofcooks.com/privacy

Website user

Cookies

Cookies are small data files that a website can transfer to an individual’s computer hard drive for record keeping. Cookies can make websites easier to use by storing information about your preferences on a particular website. The information may remain on your computer after the Internet session finishes and you leave the website but you can delete them using some browsers, manually or using system utilities. Most internet browsers are pre-set to accept cookies.

If you wish to restrict or block the cookies, which are set by NPG websites, or any other website, you can do this through your browser settings. The Help function within your browser should tell you how. For more information on cookies and their uses, visit the cookies page on the Information Commissioner’s Office website.

Most elements of the Gallery’s website will still function if you disable cookies in your web browser settings.

In general, we use cookies in the following ways:

  • Temporary, ‘session’ cookies to help you navigate through our website and to enhance your user experience. These cookies are temporary and disappear when you close your browser.
  • Analytics cookies to recognise and count visits to our website, how visitors use our website and how they get to the website. This information is used to help improve the website and services provided. Information collected in this way does not personally identify you.
  • Third Party cookies may be set by social media tools or other external applications if you are a user of those services. For example, when you visit a page with content embedded from Facebook, SoundCloud, Twitter, YouTube, Google Maps or Flickr, you may be presented with cookies from these websites. The Gallery does not control the dissemination of these cookies. You should check the third-party websites for more information about these.

Other websites and web applications

Our website may contain links to third party websites or applications. Our privacy policy does not govern these websites or applications. These applications are owned and operated by third parties, and are governed by their own specific terms. We will not accept responsibility for third party applications or for any loss or damage arising from your use of them.

We use several third parties to process transactions – please see details below:

Print on Demand, image licensing services and mobile PDQ machines by WorldPay http://www.worldpay.com/uk/privacy-policy

Online shop by Shopify payments (Stripe) https://www.shopify.co.uk/legal/terms-payments-us

Or by PayPal https://www.paypal.com/gb/webapps/mpp/ua/privacy-full

Some print orders are fulfilled and transacted by our partner, King & McGaw https://www.kingandmcgaw.com/help/privacy

The payment solution for Membership, Patronage and ticketing card transactions is TNS: https://www.tnsi.com/Privacy

Personal data for Members and Patrons who have chosen the Direct Debit payment option are verified through Bottomline Technologies software: https://www.bottomline.com/uk/terms-conditions/safe-harbor-privacy-policy/

Address verification through Experian: https://www.edq.com/uk/privacy

Google Analytics

We use Google Analytics to collect information about how our visitors use and navigate the Gallery’s website. We use this information to report to funders such as the Department for Culture, Media and Sport, and to analyse usage of the website so that we can continually work to improve the site and your experience of it. The cookies collect information such as the number of visitors to the site, which pages they visited and whereabouts they came to the site from. This information is anonymous and cannot be used to identify you personally.

Personalised advertising

If you browse the Gallery’s website, you may receive personalised banner advertisements whilst browsing other reputable websites. The Gallery has a legitimate interest in marketing our activities to those with an existing interest in the Gallery to help raise income. We are committed to providing you with information on products and offers which are relevant to you. The banner advertisements will relate to exhibition pages, events or products which have been viewed whilst browsing the Gallery’s website on your computer or other device.

This service is provided by the Gallery via reputable third-party specialist companies like Sizmek and Quantcast, through the use of cookies placed on your computer or other device. These companies may choose to target you based on your IP host address and non-Personally Identifiable Information (Non-PII). This includes but is not limited to the date and time of activity online, the pages viewed, browser type, referring URL, Internet Service Provider and operating system. These companies do not collect Personally Identifiable Information (PII) such as name, address, phone number, email, address, credit card information or anything else that can personally identify you.

You can visit these individual companies and read their privacy policies for more information on how to opt out. The Sizmek privacy policy, and Quantcast privacy policy are available online.

You may also opt out of receiving further personalised advertisements in the future by clicking on the bottom right hand corner of any advertisement you receive and following the instructions.

User Accounts

We collect information about you when you create a user account and log in to the following website services:

  • Ticket purchase/event booking
  • Making a donation
  • Membership or Patronage
  • Online shop
  • Applying for a job
  • Licensing an image
  • Subscribing to the enewsletter

We will keep your information for the necessary period for the above purposes in accordance with our retention schedules and legal compliance. Find out more about our Records Management Policy here. Once your personal information is no longer required we will delete it from our records in a secure manner. Not all records can be deleted immediately; The Gallery has statutory, legal, business continuity and administrative requirements to hold on to certain records for specified periods.

Surveys

We occasionally run surveys to improve our website and services. Cookies are used to allow the form or pop-up survey to be hidden on your return visits. This is to prevent you from being shown the survey again unnecessarily. Cookies are also used to record the overall number of answers to the survey questions and to link these to web statistics. They do not store your personal data.

Photographs in the Gallery and at Events

The Gallery reserves the right to take photographs in public and gallery spaces and at events. Individuals should notify staff if they do not wish to be photographed. All reasonable efforts will be made to gain approval (usually via a consent form) from the subject of any image of an identifiable person which the Gallery publishes in print or online. Parents/ Guardians will be asked to sign approval forms for children under 13 years old.

Ticket Purchase

We collect information about you when you purchase a ticket, book an event, create a user account or log into the ticketing section of our website.

We will keep your information for the necessary period to process your ticket purchase/s or event booking/s in accordance with our retention schedules and legal compliance. Find out more about our Records Management Policy here. Once your personal information is no longer required we will delete it from our records in a secure manner. Not all records can be deleted immediately; The Gallery has statutory, legal, business continuity and administrative requirements to hold on to certain records for specified periods.

Contacting the Gallery

If you contact us, make an enquiry, provide feedback or send us an e-mail or letter we will keep your information for a reasonable period in order to respond to you and take any necessary action. This is in accordance with our retention schedules and legal compliance (three months for standard enquiry). Find out more about our Records Management Policy here. Once your personal information is no longer required we will delete it from our records in a secure manner. Not all records can be deleted immediately; The Gallery has statutory, legal, business continuity and administrative requirements to hold on to certain records for specified periods.

Third Party Service Providers

Some onsite services are operated by third parties, and are governed by their own specific terms. Our privacy policy does not govern these third parties. We will not accept responsibility for third party applications or for any loss or damage arising from your use of them.

We use several third parties to process transactions onsite – please see details below:

Print on Demand and mobile PDQ machines by WorldPay http://www.worldpay.com/uk/privacy-policy

Framed print orders are fulfilled and transacted by our partner, King & McGaw https://www.kingandmcgaw.com/help/privacy

The payment solution for Membership, Patronage and ticketing card transactions is TNS https://www.tnsi.com/Privacy

Address verification through Experian https://www.edq.com/uk/privacy

Please note our Restaurant and Café are run by a third party, Company of Cooks (Public Restaurant Partner Ltd). When you book with the Portrait Restaurant or sign up to the Restaurant mailing list your data is being held and used by Company of Cooks http://www.companyofcooks.com/privacy

Enewsletter/newsletter subscriber

If you opt in to receive the Gallery e-newsletter/s we will use your contact information to send you the relevant e-communications. You can update your preferences by logging into your account here. If you opted in when you signed in to our onsite Wifi please email marketing@npg.org.uk to register your preferences. You can unsubscribe at any time using the link at the bottom of all e-communications.

E-communications (including the processing of the subscriber name and email address) are managed via Wordfly https://www.wordfly.com/privacy-policy/ and Mailchimp (Shop site) https://mailchimp.com/legal/privacy/.

Marketing communications

You have the right to ask us not to process your personal data for marketing purposes (e.g. providing you with information about the Gallery’s programme of exhibitions and events, shop products or fundraising initiatives). We will inform you before collecting your data if we intend to use your data for such purposes. You can stop us using your data in this way at any time by exercising your right to object to processing and contacting us at: marketing@npg.org.uk.

Supporter of the Gallery (inc. Members & Patrons)

The Gallery is an exempt charity under the Charities Act 2011 and must self-generate 60% of its income. This includes fundraising and we rely on the generosity of our supporters and sponsors to continue our work.

We use a customer relationship management system (CRM) to support our fundraising activities and to deliver an excellent service to our Members, Donors and supporters. This means that we keep the personal data you provide us with, so we are able to see the history and relevant details of your relationship with the Gallery. We take information security very seriously and no one is allowed access to our system or files unless they need this to provide the service to you, or one of the other purposes discussed in this notice.
We will never share or sell your personal data to a third-party organisation for its marketing, fundraising or campaigning purposes.

Members

When you sign up to become a Member, we will use the personal data you provide (name, address, email address, telephone number, payment details) to set up and service your membership, in order to fulfill our contractual obligations to you. This includes processing your membership subscription payment, administering your membership benefits and contacting you if there is an issue with your Membership or payment.

If you opt to Gift Aid a donation, your Membership, personal details such as your name and address will be used in the claim submitted to HMRC, which is legal requirement.
On the basis of it being within our legitimate interests to do so, whilst you have an active Membership with us we will communicate with you by post and by email according to your preferences. This includes a monthly Members E-Newsletter and a quarterly mailing consisting of an issue of the supporters’ magazine Face to Face and What’s On, the Gallery’s programme of events.

It is in our legitimate interest to contact you to update you on your Membership status, including reminders of when your Membership is due to expire. For full details please refer to the Terms and Conditions of Membership (link to https://www.npg.org.uk/about/faq/membership-terms-and-conditions)
To help us to provide the best level of service and offers to our Members every two years we will invite you to participate in the Members Survey online.
You can let us know how you would prefer to be contacted and you can object to receiving these communications at any time through your Member Account online or by contacting the Membership team at details below.

If you purchase a Membership for somebody else as a gift we will use your personal data to fulfill our contractual obligations to set up and service the Membership. If you are the recipient of a Gift Membership we will let you know from whom we were given your data (their name) and will make you aware of this Privacy Notice and how to manage your communication preferences in our first communication with you (your Welcome letter).
We will scan your Membership card to check entitlement to free entry, to understand how and when our members visit and to help us send you more relevant communications. We will carry out demographic profiling in order to provide improved communications and member benefits and your personal data may be used for NPG marketing, statistical, and analytical processes.

We will share your information with third parties who we have commissioned to act on our behalf in order to fulfill your membership. These include:

- Wordfly – the e-communications system we use to communicate with our Members: https://www.wordfly.com/privacy-policy/

-TNS - the payment solution for Membership and Patronage: https://www.tnsi.com/Privacy

- Membership Plus – For fulfillment of Membership communications, including renewal communications.

- TMB Mailing – For fulfillment of the Membership communications, including our Members quarterly mailing.

- Bottomline Technologies - For Members and Patrons who have chosen the Direct Debit payment option are verified through software: https://www.bottomline.com/uk/terms-conditions/safe-harbor-privacy-policy/

- Experian – For Address verification https://www.edq.com/uk/privacy

We will keep your information for the necessary period to process your Membership in accordance with our retention schedules and legal compliance. Find out more about our Records Management Policy here.

For details of our renewal and reactivation periods please see Membership Terms & Conditions here (link to https://www.npg.org.uk/about/faq/membership-terms-and-conditions.) Once your personal information is no longer required we will delete it from our records in a secure manner. Not all records can be deleted immediately; The Gallery has statutory, legal, business continuity and administrative requirements to hold on to certain records for specified periods.

To exercise your rights to review or amend your personal data or object to processing please contact the Membership Team on Membership@npg.org.uk

Patrons, Life Patrons, Director’s Circle, Corportate Members

When you sign up to become a Patron, Life Patron, or member of the Director’s Circle we will use the personal data you provide (name, name of partner, address, email address, telephone number, payment details) to set up and service your membership, in order to fulfill our contractual obligations to you. This includes processing your membership subscription payment, administering your membership benefits and contacting you if there is an issue with your membership or payment.

If you are affiliated with the Gallery through a corporate membership, we will use your work-based email address, work address and corporate accounts information to process payment and administer of your corporate membership, in order for us to fulfill our contractual obligations to the corporate partner.

If you opt to Gift Aid a donation, your Patronage, personal details such as your name and address will be used in the claim submitted to HMRC, which is legal requirement.
On the basis of it being within our legitimate interests to do so, whilst you have an active patronage or membership we will communicate with you by phone, post and email to invite you to events (e.g. Patrons Programme and Private Views) and to keep you updated on the work of the Gallery.

Under legitimate interest we will also contact you to update you on your membership status, including reminders of when your Patronage or Membership is due to expire.
You can let us know how you would prefer to be contacted and you can object to receiving these communications at any time by contacting the Patrons Team at patrons@npg.org.uk or the Corporate Team at msinclair@npg.org.uk.

We will scan your Patron/Membership card to check entitlement to free entry. Your personal data may be used for NPG marketing, statistical, and analytical processes.
If you attend an event at the Gallery we will use your personal data to comply with our legal obligations to deliver the event safely (e.g. collating guest lists, dietary requirements).

We will share your information with third parties who we have commissioned to act on our behalf in order to fulfill your membership. These include:

- Wordfly – the e-communications system we use to communicate with our Members and Patrons: https://www.wordfly.com/privacy-policy/

-TNS - the payment solution for Membership and Patronage: https://www.tnsi.com/Privacy

- Bottomline Technologies - For Members and Patrons who have chosen the Direct Debit payment option are verified through software: https://www.bottomline.com/uk/terms-conditions/safe-harbor-privacy-policy/

- Experian – For Address verification https://www.edq.com/uk/privacy

We will keep your information for the necessary period to process your Patronage in accordance with our retention schedules and legal compliance. Find out more about our Records Management Policy here.

For details of our renewal periods please see Patronage Terms &Conditions here (link to https://www.npg.org.uk/about/faq/membership-terms-and-conditions). Once your personal information is no longer required we will delete it from our records in a secure manner. Not all records can be deleted immediately; the Gallery has statutory, legal, business continuity and administrative requirements to hold on to certain records for specified periods.

To exercise your rights to review or amend your personal data or object to processing please contact the Patrons Team on Patrons@npg.org.uk or if you are a Corporate Member please contact msinclair@npg.org.uk.

Fundraising, Donations & Legacies

If you have not supported the Gallery before but have consented to receive fundraising information through your e-marketing preferences we may invite use your contact details to invite you to support our work by making a donation, getting involved in fundraising activities or leaving a gift in your will.
If you are a current supporter of the Gallery, on the basis of it being within our legitimate interests to do so, we may invite you to further support our work by making a donation, getting involved in fundraising activities or leaving a gift in your will.

Operating under Public Task, if you make a donation, we will use the personal information you give us to record the nature and amount of your gift, claim gift aid where you’ve told us you’re eligible and thank you for your gift. If you interact or have a conversation with us, we’ll note anything relevant and store this securely on our systems.

If you choose to Gift Aid your donation, your Membership or Patronage, we have a legal obligation to provide your name and address to HMRC in order to fulfil the gift aid claim.
Occasionally, we will invite some supporters to attend special events to find out more about the ways in which donations and gifts in wills can make a difference to specific projects and to our cause. We will also send you updates on the impact that you make by supporting us in this way, unless you tell us not to.

If you tell us you want to fundraise to support our cause, we will use the personal information you give us to record your plans and contact you to support your fundraising efforts.
If you have told us that you’re planning to, or thinking about, leaving us a gift in your will, we will use the information you give us to keep a record of this – including the purpose of your gift, if you let us know this. If we have a conversation or interaction with you (or with someone who contacts us in relation to your will, for example your solicitor), we will note these interactions throughout your relationship with us, as this helps to ensure your gift is directed as you wanted.

Charity Commission rules require us to be assured of the provenance of funds and any conditions attached to them. To meet this legal obligation, we follow a due diligence process which involves researching the financial soundness, credibility, reputation and ethical principles of donors who have made, or are likely to make, a significant donation to the National Portrait Gallery. For more information on our due diligence processes please see our Grants and Donations Policy

To exercise your rights to review or amend your data or object to processing please contact maram@npg.org.uk.

Supporer Research & Analysis

We want to meet with or deepen our connection with, individuals and organisations who might have an interest in or connection to our work. We are committed to nurturing collaborative relationships with donors, influencers, prospective donors and others so that together we can grow and sustain the Gallery for generations to come.

To enable us to find and connect with people with a passion for art, history or creative education projects and the interest and ability to support us in new and exciting ways, we may also use the information you provide to us in combination with publicly available information, if we consider it within our legitimate interests to do so.

Our Major Gifts team uses information that is already in the public domain (information that has been published in print or online) to identify high net worth individuals who may be interested in supporting our work with a major gift. These publicly available sources of information include Companies House, the electoral register, the phone book, the Charity Commission’s Register of Charities, Who’s Who, LinkedIn, company annual reports, and articles in newspapers and magazines. We do not use publicly available sources which we consider would be intrusive for this purpose, such as Facebook, Twitter, JustGiving, the Land Registry, online planning applications, or similar websites. We also carry out research to identify existing supporters who may be able to join our major donor programme. This is based both on publicly available information, and information our supporters have given us voluntarily (e.g. where a person lives, who they bank with, what their occupation is and their age).

We may use profiling and database segmentation techniques to analyse your personal information, and create a profile of your interests, preferences and ability to donate. This allows us to ensure communications are relevant and timely, to provide an improved experience for our supporters. It also helps us understand our supporters so that we can make appropriate requests to those who may be willing and able to donate more than they already do, or leave a gift in their will. This enables us to raise funds in the most cost-effective way.

Under data protection legislation, you have the right to object to your data being processed in this way. If you wish to opt out of being identified as a high net worth individual, or to review or amend your personal data please contact maram@npg.org.uk.

Please remember we are legally required to carry out checks on individuals who give us large donations, to comply with our legal obligation in respect of anti-money laundering legislation and the prevention of fraud.

Shop customer

We collect information about you when you make a purchase, create a user account or log into the online shop.

We will keep your information for the necessary period to process your order/transaction in accordance with our retention schedules and legal compliance. Find out more about our Records Management Policy here. Once your personal information is no longer required we will delete it from our records in a secure manner. Not all records can be deleted immediately; The Gallery has statutory, legal, business continuity and administrative requirements to hold on to certain records for specified periods.

Third Party Service Providers

Some shop services are operated by third parties, and are governed by their own specific terms. Our privacy policy does not govern these third parties. We will not accept responsibility for third party applications or for any loss or damage arising from your use of them.

We use several third parties to process transactions – please see details below:

Print on Demand, image licensing services and mobile PDQ machines by WorldPay http://www.worldpay.com/uk/privacy-policy

Online shop by Shopify payments (Stripe) https://www.shopify.co.uk/legal/terms-payments-us

Or by PayPal https://www.paypal.com/gb/webapps/mpp/ua/privacy-full

Framed print orders are fulfilled and transacted by our partner, King & McGaw https://www.kingandmcgaw.com/help/privacy

Image licensee

We collect information about you when you licence an image, create a user account and log in to the image licensing website at www.npgimages.com.

We will keep your information for the necessary period to administer your image licence request/order in accordance with our retention schedules and legal compliance. Find out more about our Records Management Policy here. Once your personal information is no longer required we will delete it from our records in a secure manner. Not all records can be deleted immediately; The Gallery has statutory, legal, business continuity and administrative requirements to hold on to certain records for specified periods.

Restaurant customer

The Gallery’s Restaurant and Café are run by a third party, Company of Cooks (Public Restaurant Partner Ltd). When you book with the Portrait Restaurant or sign up to the Restaurant emailing list your data is being held and processed by Company of Cooks. http://www.companyofcooks.com/privacy

Archive and library user

We collect information about you when you:

  • Book an appointment to visit the Heinz Archive & Library
  • Complete a Visitor Agreement form to register as a user of the Heinz Archive & Library or view an object not on display
  • Make a research enquiry or correspond with staff

Visitors to the Heinz Archive and Library

When you make a request to visit the Heinz Archive & Library, we will use the personal data you provide (name and contact details) for the purposes of processing your booking, keeping you informed about your appointment and any changes, and to allow a visitor pass to be created for the day of your visit. We use your information for these purposes as part of our public task to make our resources available to researchers, and in the vital interest of safety and security.

When you first visit the Heinz Archive & Library, you will be required to complete a Visitor Agreement form with your personal information. This is to allow you access to the Heinz Archive and Library and the material it holds, to record your agreement to abide by the conditions the forms sets out, and to contact you after your visit in the event of any issues or concerns. These purposes fall within our public task to make our resources available to researchers, and our legal obligations in relation to copyright and data protection.

The personal information you provide as a visitor to the Heinz Archive & Library will not be shared with external third parties or any other organisations.

Your visitor pass and associated information will be deleted on the date your access expires (usually at the end of the day of your visit). We will keep your booking information for two years and a copy of your Visitor Agreement form for six years for the above purposes, in accordance with our retention schedules and legal compliance. Find out more about our Records Management Policy here.

Once your personal information is no longer required we will delete it from our records in a secure manner. Not all records can be deleted immediately; The Gallery has statutory, legal, business continuity and administrative requirements to hold on to certain records for specified periods.

Making a Research Enquiry

When you make a research enquiry or correspond with staff regarding British portraits, the history of the Gallery or items in the Gallery’s Collections, we will use the personal data you provide (name and contact details) for the purposes of recording your enquiry and responding to your request. We use your information for these purposes as part of our public task to make our resources available to researchers, and it will not be shared with external third parties or any other organisations.

Enquiries and correspondence regarding items not in the Gallery’s Collections or which are of no ongoing research value will be deleted three years after the last meaningful correspondence on that subject. Enquiries and correspondence regarding items in the Gallery’s Collections, or that the Gallery deems to be important for historical or research purposes will be kept for permanent preservation in the Gallery Records. This is for archiving in the public interest, and any sensitive or personal data will be withheld from the public. This is in accordance with our retention schedules and legal compliance. Find out more about our Records Management Policy here.

Once your personal information is no longer required we will delete it from our records in a secure manner. Not all records can be deleted immediately; The Gallery has statutory, legal, business continuity and administrative requirements to hold on to certain records for specified periods.

Archiving personal data for research purposes

The Gallery will select relevant documents/communications obtained through public research enquiries and correspondence with staff about the Gallery’s Collections for permanent preservation and retain records indefinitely for research purposes and archiving in the public interest. Any sensitive information will be withheld from the public

Lender, seller or object donor

We collect information about you when you:

  • Offer to gift, sell, bequeath, leave on temporary deposit or loan an object to the Gallery – whether it is ultimately accepted or not
  • Supply information for loans management purposes
  • Correspond with staff and provide information which may be retained for research purposes, some of which may be selected for permanent retention within the Gallery’s archive

We will keep your information for the necessary period for the above purposes in accordance with our retention schedules and legal compliance. Find out more about our Records Management Policy here. Once your personal information is no longer required we will delete it from our records in a secure manner. Not all records can be deleted immediately; The Gallery has statutory, legal, business continuity and administrative requirements to hold on to certain records for specified periods.

Prize or award competition entrant

If you enter the BP Portrait Award or Taylor Wessing Photographic Portrait Prize weuse your data to process your entry as set out in the rules of entry.

We will keep your information for a reasonable period for the above purposes in accordance with our retention schedules and legal compliance. Find out more about our Records Management Policy here. Once your personal information is no longer required we will delete it from our records in a secure manner. Not all records can be deleted immediately; The Gallery has statutory, legal, business continuity and administrative requirements to hold on to certain records for specified periods.

Job applicant

We collect information about you when you create a user account and log in to our recruitment system.

Unless otherwise agreed with you, we will keep your information for six months to administer your job application in accordance with our retention schedules and legal compliance. Find out more about our Records Management Policy here. Once your personal information is no longer required we will delete it from our records in a secure manner. Not all records can be deleted immediately; The Gallery has statutory, legal, business continuity and administrative requirements to hold on to certain records for specified periods.

Staff and ex-employees

In order to comply with it’s contractual, statutory, legal and management obligations and responsibilities, the Gallery is required to process personal data relating to its employees and volunteers. Details are provided to staff/volunteers at the commencement of employment at the Gallery.

Volunteer

We collect information about you when you apply for a volunteer role at the Gallery.

Unless otherwise agreed with you, we will keep your information for the duration of the recruitment process. Once your personal information is no longer required we will delete it from our records in a secure manner.

When you join us as a volunteer, we collect information about you for administration and safeguarding purposes, as well as to communicate with you regarding your volunteering. When you leave us, we will keep your information for two years unless otherwise requested by you. This enables us to provide references. After this period, we will delete your personal information from our records in a secure manner.

Copyright owner

We hold the details of copyright owners for legal purposes. We will keep your information for the necessary period in accordance with our retention schedules and legal compliance. Find out more about our Records Management Policy here. Once your personal information is no longer required we will delete it from our records in a secure manner. Not all records can be deleted immediately; The Gallery has statutory, legal, business continuity and administrative requirements to hold on to certain records for specified periods.

Notice and Take Down Policy

Please contact us in the event that you are the owner of the copyright or related rights in any of the material on this website, or in a publication or broadcast to which the National Portrait Gallery has provided material from its collections, and you believe that the material may be subject to a third party ownership or another legal claim, or you believe that the use of this material infringes your intellectual property or any other rights.

We will withdraw the material from our website within 24 hours of receipt of your written objection and our initial verification of your complaint, while the matter is investigated. Your objection will be acknowledged within seven working days of receipt.

Please include the following information in your email:

  • Your contact details
  • The full details of the material you believe has made the infringement and where you found it
  • Proof or statement that you are the rights holder

Please send your query to rightsandimages@npg.org.uk and a member of the Rights and Images team will deal with your enquiry as soon as possible.