We take your privacy very seriously and we are committed to protecting it. Please read this privacy policy carefully as it contains important information about who we are and how and why we collect, store, use and share your personal information. It also explains your rights in relation to your personal information and how to contact us or supervisory authorities if you have a complaint.
We collect and use certain personal information about you. When we do so we are subject to the General Data Protection Regulation, which applies across the European Union (including in the United Kingdom), and the Data Protection Act 2018, which applies in the United Kingdom only, and we are responsible as ‘controller’ of that personal information for the purposes of those laws.
Key terms
It would be helpful to start by explaining some key terms used in this policy:
|
Somerset House, we, us, our |
Somerset House Trust (a company limited by guarantee with registered company number 03388137 and registered charity number 1063640); and Somerset House Enterprises Limited (a limited company with registered company number 03920330). Both entities are registered at Somerset House, Strand, London WC2R 1LA. |
|
Personal information |
Any information relating to an identified or identifiable individual. |
|
Special category personal information |
Personal information revealing racial or ethnic origin, political opinions, religious beliefs, philosophical beliefs or trade union membership Genetic and biometric data Data concerning health, sex life or sexual orientation Information concerning any offences (including alleged offences), criminal proceedings, outcomes and sentences. |
Somerset House’s privacy policy in a nutshell
We aim to be clear when we collect your personal information and not to do anything you wouldn’t reasonably expect. The principles we apply in dealing with your personal information are:
- We never sell your personal information
- We won’t share your personal information externally except
- for marketing purposes with your express consent; or
- with specific processors legitimately acting on our behalf and with proper/appropriate safeguards in place; or
- if legally required
- We keep all personal information within Somerset House-managed systems where access is carefully controlled
- We will only take and use your personal information where necessary and for a legitimate purpose
- We won’t warehouse your personal information and only retain it if it is necessary to do so.
- We will never send your personal information outside the EEA (the European Economic Area).
If you have any questions about how we process your personal information or if you wish to opt out of certain types of processing or communications, please contact us on the contact details set out below.
Why we use your personal information
We use (or ‘process’) your personal information when we have a proper reason for doing so, namely because it is necessary:
- for the performance of our contract with you or to take steps at your request before entering into a contract;
- for our legitimate interests or those of a third party;
- to comply with our legal and regulatory obligations; or
- where you have given consent.
A legitimate interest is when we have a business or commercial reason to use your information, so long as this is not overridden by your own rights and interests. Where we use legitimate interests to process information, we have carried out a balancing exercise that considers our need to process your information against your privacy rights.
We may process your personal information for the performance of a contract where, for example, you purchase from us tickets, merchandise, or guided tours; where you sign up for public Wi-Fi; or where you enter into a resident tenancy, an exchange licence or a Somerset House Studios residency with us.
We may process your personal information because it is in our legitimate interests to do so, for example to inform you of other products, services or events related to Somerset House, such as exhibitions, gigs, film screenings, shows; to update you on Somerset House news, e.g. via e-newsletters and occasional postal mailings; to provide information on fundraising campaigns, activities and appeals, including occasional general or tailored requests to consider giving financial support to Somerset House, or to ask you to consider supporting Somerset House by giving your time; to maintain and cultivate our relationships with you (particularly if you are an artist, consultant, professional colleague, partner or potential supporter).
We may process your personal information to comply with our legal and regulatory obligations in conducting checks to identify our customers and verify their identities or in screening for financial and other sanctions or embargoes (e.g. potential donors).
We may also process your special category personal information where:
- it is necessary for medical purposes (e.g. in a medical emergency);
- it is necessary to protect your or another person’s vital interests; or
- we have your explicit consent to do so.
How we collect your personal information
We collect most of your personal information directly from you. You may give us information by filling in forms on Somerset House’s website or by corresponding with us by telephone, email, face-to-face or otherwise. For instance, we gather information when people book for an event or exhibition at Somerset House or sign up to one of our mailing lists.
However, we may also collect information:
- from publicly accessible sources, e.g. Companies House or social media (e.g. LinkedIn, Facebook)
- from public sources for charities (in order to find information about those charities’ employees, trustees, etc. and to find information about donations and support)
- from public sources for individuals (collated lists that are publicly available)
- press sources (e.g. newspaper articles and databases), which may include media monitoring (e.g. Google alerts)
- directly from a third party, e.g.:
- customer due diligence providers
- sanctions screening providers
- credit reference agencies
- from a third party with your consent
- from cookies on our website—for more information on our use of cookies, please see our Cookie Policy
- via our IT systems, e.g.:
- access-controlled entry systems and reception logs;
- automated monitoring of our websites and other technical systems, such as our computer networks and connections, CCTV and access control systems, communications systems, email and instant messaging systems.
- in photographs documenting an event or activity at Somerset House where it would not be necessary, appropriate or practicable to obtain your specific consent (for example, we may seek specific consent for prominent or impactful uses, but typically not for group shots, background inclusion or internal use).
The information we get from other organisations may depend on your privacy settings or the responses you give to these websites. We recommend that you check these settings regularly.
As part of standard fundraising practice, if you are proposing to donate a significant gift to Somerset House we will carry out due diligence research, including reviewing publicly available personal information, into whether your gifts have been accepted elsewhere and whether there is any substantiated negative press about you, including in relation to money laundering, which may negatively impact on Somerset House’s reputation. This research is carried out in accordance with the Donor Charter and Public Fundraising Statement (set out at the end of this document) of Somerset House’s Fundraising Policy.
What personal information we collect
We may collect and use the following personal information about you:
- your name and contact information, including email address and telephone number and (if applicable) company details
- Information to enable us to check and verify your identity, e.g. your date of birth
- your gender information, if you choose to give this to us
- location data, if you choose to give this to us
- your billing information, transaction and payment card information, including event payments, donations and Gift Aid declarations
- if you are a regular donor giving via direct debit, details of your direct debit instruction including your bank account details
- your previous booking history
- your contact history, purchase history and saved items
- information you make available on our social media accounts e.g. ‘likes’, posts and responses to our Facebook pages, Twitter and Instagram feeds and YouTube videos
- information to enable us to undertake credit or other financial checks on you
- Information about how you use our website, IT, communication and other systems
- your responses to surveys, competitions and promotions
- information provided by you for specific purposes (e.g. disability and dietary preferences for event management purposes)
- records of Somerset House events you register for and attend
- records of communications and interactions we’ve had with you
- if you volunteer your time to Somerset House, your volunteer activities
- information relating to your philanthropy and other giving, including donations to other organisations (which you may tell us about, or about which we may learn through the media)
- images of you when captured in photographs of our events in which you appear and CCTV
Promotional communications
We may use your personal information to send you updates in accordance with your preferences about our products and services, including exclusive offers, promotions or new products and services.
We make it easy for you to tell us how you want to hear from us by logging on to our website, visiting the ‘Manage my account’ area of the site and selecting ‘Update your interests’. We suggest you do that now, so that we have your most up-to-date contact preferences and can continue to communicate with you in the ways you would like.
We send out emails about the following areas:
- Somerset House full programme, news and offers
- Somerset House Studios and appropriate related events
- learning and participation opportunities and appropriate related events
- ways in which you can support Somerset House
Some of our events are produced with partner organisations. If you book for these events through our ticketing system, you can specify if and how you would like to be contacted by Somerset House and the partner organisation respectively at the point of booking.
You have the right to opt out of receiving promotional communications at any time by:
- using the ‘unsubscribe’ link in emails or a ‘STOP’ reply in texts
- updating your contact preferences.
- If you need further assistance you can also contact us at marketing@somersethouse.org.uk
We may ask you to confirm or update your marketing preferences if you instruct us to provide further products and services in the future, or if there are changes in the law, regulation, or the structure of our business.
There are certain types of event-specific emails that you will always receive from us, regardless of your contact permissions. These include confirmation of booking, pre-visit information, post-visit information to gather feedback or notification if we need to change or cancel an event. These communications are sent to assist you with your booking and your visit, and are sent irrespective of any contact preferences you have supplied to us.
Disclosures of your personal information
Other than with your consent we only allow our service providers to handle your personal information if we are satisfied they take appropriate measures to protect your personal information. We also impose contractual obligations on service providers to ensure they may only use your personal information to provide services to us and to you. We may also share personal information with external auditors.
We may disclose and exchange information with law enforcement agencies and regulatory bodies to comply with our legal and regulatory obligations.
We will not share your personal information with any other third party.
We only routinely share personal information with:
- companies within the Somerset House group and employees, temps, volunteers and agents of Somerset House;
- third parties we use to help deliver our events, products and services to you, such as payment service providers, business associates and other professional advisers.
How long your personal information will be kept
We will keep your personal information while you have an account with us or we are providing products and services to you or while it is in both our interests to maintain our relationship (as outlined in the table above (see ‘How and why we use your personal information’). Thereafter, we will keep your personal information for as long as is necessary:
- to respond to any questions, complaints or claims made by you or on your behalf;
- to show that we treated you fairly;
- to keep records required by law.
We will not retain your personal information for longer than necessary for the purposes set out in this policy. Different retention periods apply for different types of personal information.
When it is no longer necessary to retain your personal information, we will delete or anonymise it.
Your rights
You have the following rights, which you can usually exercise free of charge:
|
Access |
The right to be provided with a copy of your personal information (the right of access) |
|
Rectification |
The right to require us to correct any mistakes in your personal information |
|
To be forgotten |
The right to require us to delete your personal information—in certain situations |
|
Restriction of processing |
The right to require us to restrict processing of your personal information—in certain circumstances, e.g. if you contest the accuracy of the information |
|
Data portability |
The right to receive the personal information you provided to us in a structured, commonly-used and machine-readable format and/or transmit that information to a third party—in certain situations |
|
To object |
The right to object: —at any time to your personal information being processed for direct marketing (including profiling); —in certain other situations to our continued processing of your personal information, e.g. processing carried out for the purpose of our legitimate interests. |
|
Not to be subject to automated individual decision-making |
The right not to be subject to a decision based solely on automated processing (including profiling) that produces legal effects concerning you or similarly significantly affects you |
For further information on each of those rights, including the circumstances in which they apply, please contact us at datarequests@somersethouse.org.uk or see the Guidance from the UK Information Commissioner’s Office (ICO) on individuals’ rights under the General Data Protection Regulation.
If you would like to exercise any of those rights, please:
- email, call or write to us — see below ‘How to contact us’; and
- let us have enough information to identify you (e.g. your full name, address and customer or matter reference number);
- let us have proof of your identity and address (a copy of your driving licence or passport and a recent utility or credit card bill); and
- let us know what right you want to exercise and the information to which your request relates.
Keeping your personal information secure
Your information will be held and processed on Somerset House systems or systems managed by suppliers on behalf of Somerset House. All third parties we instruct to hold and otherwise process your information will be legitimately acting on our behalf and with proper and appropriate safeguards in place.
We maintain a customer relationship management (CRM) system to hold contact details and a record of your interactions with Somerset House such as ticket purchases, donations, queries, complains and attendance at events. We aim to keep a single record for each individual.
We have appropriate security measures to prevent personal information from being accidentally lost, or used or accessed unlawfully. We limit access to your personal information to those who have a genuine business need to access it. Those processing your information will do so only in an authorised manner and are subject to a duty of confidentiality. Your special category information is only made available to members of staff who have a reason to work with it.
We also have procedures in place to deal with any suspected data security breach. We will notify you and the UK regulator (the Information Commissioner’s Office (ICO)), of a suspected data security breach where we are legally required to do so.
How to complain
We hope that we can resolve any query or concern you may raise about our use of your information.
However, if we haven’t been able to do so, you also have the right to lodge a complaint with the ICO, who may be contacted at https://ico.org.uk/concerns or telephone: 0303 123 1113.
Changes to this privacy policy
This privacy notice was published on 5 September 2019.
This policy may change from time to time so please check this page occasionally to ensure you’re happy with any changes.
How to contact us
Please contact us by post or email if you have any questions about this privacy policy or the information we hold about you.
|
Somerset House, Strand, London WC2R 1LA |