Privacy policy

Dulwich Picture Gallery wants to provide clear and concise information on how we use personal information and protect privacy. This privacy notice outlines who we are and how we collect, use and store your personal information.

We will use the information that we collect about you in accordance with the Data Protection Act 1998 and the Privacy and Electronic Communications Regulations 2003. From 25 May 2018 new data protection rules known as the General Data Protection Regulation (and related UK legislation) come into effect; this notice has been drawn up to comply with those rules.

Any changes we may make to our privacy notice in the future will be posted on this page. Please check back frequently to see any updates or changes to this notice. Any significant changes will be notified to you directly wherever possible, and by whatever practical means.

This notice was last updated in December 2022.

1. Who we are

Dulwich Picture Gallery is the UK’s oldest purpose-built public art Gallery, with a world class collection of Old Master paintings housed in Sir John Soane’s iconic building at Gallery Road.

Dulwich Picture Gallery is a charitable company limited by guarantee, company number 10445344 and registered charity number 1171287, with its place of business at Gallery Road, London SE21 7AD, and is governed by a Board of Trustees who are also Directors under the Companies Act. Dulwich Picture Gallery Enterprises Limited, company number 03173890 (‘DPGE’), is a wholly owned subsidiary of Dulwich Picture Gallery which trades on the Gallery’s behalf and exists to support it

Under this notice, ‘Dulwich Picture Gallery’ refers to both Dulwich Picture Gallery and DPGE. Together, for the purposes of how we control and manage the personal data of supporters and visitors, we are the Dulwich Picture Gallery group.

Where we talk about ‘Friends’ and ‘Patrons’ we are referring to members of the Dulwich Picture Gallery Friends and Patrons membership schemes respectively.

We will never sell, rent or exchange your personal information with any other organisation outside the Dulwich Picture Gallery group.

2. What personal information do we collect?

We only collect personal information that is necessary to run the Gallery, to fulfil our obligations to you and keep you informed about our activities. Personal information is defined as information that identifies a living person, or which can be defined as relating to a living person.

The type of personal information we collect depends on where and when it is gathered. We may collect, store and process the following information about you:

• your first name, last name and title;
• (in the case of Friends or Patrons) the first name, last name, and title of any joint members;
• your (and any second member) contact details, including your email address(es), postal address(es) and phone number(s)
• (in the case of an Under 30 subscription) your date or birth;
• any access or special requirements;
• financial information, such as credit card information, or bank details for setting up a regular direct debit. If you select to store your card details via our online ticketing website, your card details are tokenised and encrypted in accordance with leading industry security standards by our payment provider, Payment Express.
• your interests, contact preferences and previous activities with the Gallery, such as ticket purchases, donations, online shop purchases, event registration and attendance;
• feedback submitted in relation to the Gallery and responses to our visitor surveys;
• details of Gift Aid declarations;
• images recorded on our CCTV cameras;
• images captured in photographs documenting an event or activity at the Gallery where it may not be necessary to obtain specific consent;
• MAC (media access control) addresses of any device(s) you bring with you to the Gallery and use via the onsite Wifi.

Special category data

Under data protection law, certain categories of personal information are recognised as sensitive (special category data), this includes health and dietary information, religious or ethnic information, trade union membership, or criminal records information. We will only collect such information where there is a clear reason for doing so, for example:

• if you participate in one of our social prescription-style programmes (Prescription for Art) we may receive information from a doctor, carer or family member in order to enable us to deliver the service to you.
• when applying for a job
• when completing the visitor survey

As with all the personal information we hold, sensitive information is held securely and restricted to those who need to use it. We will delete sensitive information when we no longer need it.

3. How do we collect your personal information?

We collect information provided to us directly by you, and indirectly from other sources about the services you use and how you use them.

Personal information may be collected directly from you when you:

• create an online account on the website;
• purchase a ticket through the website, in person or over the phone; become a Friend or Patron (see section 7 for full details on how we collect your information as a Friend or Patron);
• sign up to our email newsletter;
• make a donation;
• complete a post-event or on-site visitor survey;
• communicate with us via email, phone or post;
• apply for a job
• purchase item(s) from our shop online or via our online print-on-demand service

Personal information may be collected indirectly about you:

• when you visit our website (see our Cookie Notice for full details on how we collect information about you when you visit our website);
• when you view and interact with our emails and advertisements;
• through the use of CCTV in and around our premises for monitoring and security purposes;
• via your MAC address when you visit the Gallery, for the purpose of maintaining our free public WiFi;
• when you follow our social media channels such as Facebook, Instagram and Twitter. Depending on your privacy settings, and the policies of these services, you might give third parties (like Dulwich Picture Gallery) permission to access personal information from your accounts.

4. How do we keep your information safe and secure?

Your personal information, including in your capacity as a Friend or Patron, will be held and processed on Dulwich Picture Gallery’s systems on behalf of the Dulwich Picture Gallery group. We maintain a customer relationship management (CRM) system to hold contact details and a record of your interactions with Dulwich Picture Gallery such as ticket purchases, donations, Gift Aid declarations, memberships, queries, customer service issues, complaints and attendance at special events. Where possible we aim to keep a single record for each customer.

Your data is always held securely. Access to customer information is strictly controlled. The CRM system can only be accessed by people who need it to do their job. Certain data, for example any sensitive or financial information, has additional levels of control and safeguards and is only made visible to members of staff who have a reason to work with it.

Our CRM system is hosted by our supplier on servers in Ireland within the EEA and under EU data protection regulations. We comply with all applicable UK and EU data protection legislation in force in respect of any personal information you submit to us. The personal data you submit to us will only be used for the specified purposes indicated to you and, except where we are so required by law, will not be passed onto unauthorised third parties without your explicit consent. Please note that for technical reasons, we may sometimes need to use the services of a supplier outside the European Economic Area (‘EEA’) and transfer your personal data to countries outside the EEA that may not have the same level of data protection as countries within the EEA. However, if we intend to do this, before any transfer takes place we will put in place contractual arrangements to ensure that there is adequate protection of your data and that these comply with European data protection regulations.

We may need to disclose your details if required to the police, regulatory bodies or legal advisors.

Any information held on children and vulnerable adults is secured so that only staff who have been through an enhanced DBS clearance check who need to use it for work can access it. We will only share information about concerns with agencies who need to know, and would involve parents and/or carers as appropriate in line with our safeguarding notice.

We will only ever share your data in other circumstances if we have your explicit and informed consent.

You have the right to have the right to be forgotten and we will delete all data held on you (unless we are legally bound to keep it). Please see section 8 for full details on your rights in relation to your personal information.

5. How do we use your information and why?

We use your personal information to manage your interactions with us: in personal visits to the Dulwich Picture Gallery, in visiting our website, or in communicating with us (including to make purchases, give gifts or memberships, or make appropriate fundraising asks). We aim to be clear when we collect your data and not to do anything with it that you would not reasonably expect.

We use your personal information to contact you when it is:

i. Necessary for the fulfilment of a contract. This includes when you:

• Purchase a ticket online – we will email you about your booking
• Sign up as a Friend or Patron – in accordance with membership terms, we will contact you the magazine, Gallery updates, invitations to private views, membership renewal, direct debit payments ect.

ii. Necessary for our legitimate interests

A legitimate interest is when we have a business or commercial reason to use your information, without overriding your own rights and interests.

Some examples may be to:

• Inform you of similar exhibitions, events or products when you have purchased an exhibition or event ticket or product from our online shop
• Send you a voluntary, anonymised online survey allowing you to give us feedback when you have purchased an exhibition or event ticket
• Inform you of an appeal if you have previously supported an appeal for funding
• Provide you with information about our Friend membership scheme if you are a frequent ticket buyer or about our higher-level Patron membership scheme if you are an active Friend. (See section 7 for full details on how we use your information as a Friend or Patron)
• Carry out basic, legally required due diligence if you are approaching us as a major donor
• Inform you of our fundraising activities (See section 8 for full details on Fundraising as a legitimate interest)

We reserve the right to bring other legitimate interests to your attention in the future. Broadly, however, any reasonable activity designed to promote the Dulwich Picture Gallery's objectives – including offers, promotions, marketing and fundraising activity, and due diligence about our donors – would be a legitimate interest, provided it is carried out lawfully and fairly.

Third Parties

We use third party distributers to distribute materials, for example a mailing house will collate and send out our Whats On guide. We have explicit agreements with these third parties and they do not store your data.

We will not otherwise share your personal information with third party organisations except as clearly stated in this notice (namely, where required by law or if your preferences permit it).

6. Your consent and preferences

Where required by law, or where we think it appropriate, we will rely on your consent to tell you about events, shop offers, priority booking and information about our site. Occasionally, again in line with your preferences, we may include information in these communications from partner organisations or organisations who support us.

We make it easy for you to tell us how you want to hear from us, either by registering on our website and setting or updating your preferences, or by telling our Visitor Experience team over the phone or in person. You can opt out from these marketing communications at any time – every email sent to you will tell you how to do this.

You can update your preferences online at any point by visiting the ‘Contact Preferences’ page in you ‘Account’ section, You can choose whether you would like to receive our marketing and fundraising communications by email or post, and which type of communication you wish to receive. Unless one of these boxes appears as ticked it means we will not be contacting you for marketing and fundraising purposes. We will include opt-out instructions in any marketing or fundraising communications you receive from us.

We do not sell personal details to third parties for any purpose. We will only share personal details for the purposes of marketing if you have given explicit consent for us to do this. If we run an event in partnership with another named organisation your details may need to be shared for them to help us run the event, this will be notified to you.

If you have opted in to receiving marketing or fundraising communication from Dulwich Picture Gallery we will continue to communicate with you unless you tell us you would like us to stop. However, if you have not interacted with us for a certain period of time since your consent, we will then make contact to check if you still want us to communicate with you – in most cases within three years. At this stage, if you do not opt in to receiving communication we will cease to communicate with you, unless you opt in to communication again at a later date.

If you have opted out of marketing communications, we may still need to get in touch with you. For example, we may email you to give you important information about the events you’ve booked or to tell you about any changes to those events; or to confirm details of purchases made.

7. How long do we keep your personal information?

We will only keep your personal information for as long as is necessary. The retention period will vary dependent on the original purpose under which your information was collected.

If you have an account with us, created by yourself or by one of our staff on your behalf, we will retain your account on our systems unless you request for your information to be removed.

If you have signed up to receive email marketing, we will keep your information on our system unless you unsubscribe or request to be removed. Where you ask us to stop contacting you for marketing purposes, we will keep a record of your contact preference to ensure we no do not continue to contact you. Your account will not be removed from our system unless requested.

Where you have opted in to Gift Aid a donation or a membership, we will keep a record of your declaration for six years, as required by HMRC.

In some circumstances you can request for your personal information to be deleted, please see section 8 for full details on your rights in relation to your personal information.

8. Friends and Patrons

When you join as a Friend or Patron we collect information about you in order to manage your membership appropriately, and as part of the fulfilment of your membership. This includes to:

• send your membership benefits by post i.e. your membership welcome pack and cards, InView magazine etc;
• provide you with services (i.e. send you an email bulletin or text message)
• talk to you about Dulwich Picture Gallery and Dulwich Picture Gallery Enterprises Limited (i.e. fundraising communication about our charitable work and notification of shop discounts);
• personalise your experience of Dulwich Picture Gallery (i.e. to build a picture of your interests which means we can tell you about programme and product offerings that are most relevant to your interests)

Where adequate measures have been taken to secure your personal information, for example by way of a cryptographic hash function, this information may be provided to third parties, for example an outsourced mailing house or membership card supplier, to process lawfully and in accordance with any consents you have previously given.

On all communication with you we will provide you with the opportunity to opt out of the communication. While you remain a Friend or Patron, we will continue to communicate with you specifically about your membership.

9. Fundraising

Fundraising is vital for the financial stability of Dulwich Picture Gallery. We receive no regular statutory income and only receive around 30% of our income from ticket sales, so we rely on the generosity of individuals, trusts and companies. This is why we consider fundraising activity to be within our legitimate interests.

We believe that the most appropriate way to raise money is to make tailored asks for support, which are appropriate to individuals’ circumstances and for relevant projects. To help us make appropriate requests we look at the information we hold on individuals and information held within the public domain. This may include information found in places such as Companies House, your biography on your work website or information that has been published in articles or newspapers.

We do not use third party companies to undertake any form of wealth screening with any of the data we hold.

You can opt in to receive information about supporting Dulwich Picture Gallery by logging in to our website and updating your preferences in you ‘Account’ section, or by speaking to the Development Department. We will tell you about our current appeals that we think are most relevant to you, and can offer invitations to events where you and your family can get closer to our artistic programme by joining one of our Patron schemes - the 1811 Club or Desenfans Circle.

Our supporters tell us that they generally prefer a personal approach and want us to respond to their specific interests; this means we maintain information to ensure we have appropriate communications with our supporters or potential supporters. We want to ensure our communications to our supporters are personal, relevant and timely. We may analyse geographic, demographic and publicly available information relating to you in order to better understand your interests, to send you the most relevant communications and ensure we offer you opportunities which are of interest.

In addition, we invite some people who might be interested in joining one of our supporter groups to special events eg. drinks receptions or Private Views or to tell you about our need for support and the benefits we offer for supporters. Guests we invite might include current supporters, Friends, people who have made donations in the past, audiences who attend concerts and events regularly, audiences who have identified a specific programme interest in the via our email marketing, friends of current supporters, our Board and staff. We make sure that our invitations are appropriate and cost effective by conducting research and analysing our database which might include looking at audience members’ ticket history, address and previous donations as well as publicly available information (including newspaper articles, listed Directorships, social media profiles and biographies on employers’ websites).

We invite a select number of guests to our fundraising events to ensure they are financially viable. If you haven’t had an invitation but are interested in supporting and would like to attend please do let us know on development@dulwichpicturegallery.org.uk.

We may share anonymised personal information with other organisations, such as funders, who use this to analyse our audience development programmes, ticket sales and self-generated funding to understand the impact of their support.

Fundraising Regulator

We are a member of the Fundraising Regulator and aim to comply with their fundraising guidance. Should you wish to lodge a complaint this will trigger a removal of you from any further fundraising communications from Dulwich Picture Gallery. We report annually to the Fundraising Regulator on any complaints we have received.

10. What are your rights in relation to your personal information?

You have the following rights related to your personal data:

• The right to request a copy of personal information held about you
• The right to request that inaccuracies in personal data we hold be corrected
• The right to request us to stop processing your personal data
• The right to withdraw consent, where we are relying on it
• The right to object to use of your personal data for our direct marketing or fundraising activity
• The right to request erasure of any irrelevant, inaccurate or unnecessary information we hold
• The right to lodge a complaint with the Information Commissioner's Office or Fundraising Regulator

Please note that these rights are not absolute rights in every case: for example, the right to receive copies of your personal data is subject to various exemptions, and any objection to processing or to correct or erase data can be refused if we have a good and lawful reason to continue processing.

11. Contact us

Please contact us if you have any questions about our privacy notice or information we hold about you:

• Email us at enquiries@dulwichpicturegallery.org.uk
• Or write to us at: Data Protection, Dulwich Picture Gallery, Gallery Road, London SE21 7AD

We will respond to your requests within all applicable timeframes in accordance with the Information Commissioner’s Office guidelines.

This privacy notice has been drafted with the intention of providing clear and concise information. It does not provide exhaustive detail of all aspects of Dulwich Picture Gallery’s collection and use of personal information. Please get in touch using the contact details above if you require additional information or further clarity.

Complaints and enquiries about, or suggestions for improvements to our data protection processes should be directed to enquiries@dulwichpicturegallery.org.uk.

If you are not happy with how we have handled your complaint, you can contact the Office of the Information Commissioner, which oversees the protection of personal data in the UK, or the Fundraising Regulator directly.