Privacy Notice

This information is also available as a PDF file: University Gallery Privacy Notice

1. Introduction and Data Controller

The University of Northumbria at Newcastle (“we”, “our”, “us”) is registered with the Information Commissioners Office as a Data Controller – Registration Number Z7674926. We are committed to processing personal data in accordance with our obligations under the UK General Data Protection Regulation (GDPR) and related UK data protection Act 2018.

This privacy notice describes how and why we process personal data in relation to Gallery enquirers, clients, partners, or artists (“you”, “your”) for the purpose of managing our relationship with you and explains how you can control the processing of your data or exercise your rights under the GDPR.

2. How do we get your personal data?

We collect most of this personal information directly from you in person, by telephone, email and/or via our website. However, we may also collect information:

  • From cookies on our website
  • From publicly available information published on your own website or from professional online sources, such as LinkedIn
  • From agents acting on your behalf
  • From various or other professional organisations
  • CCTV images when you visit the gallery

3. Categories of Personal Data we process

Personal data, or personal information, means any information about an individual from which that person can be identified. To carry out our activities and to manage our relationship with you, we may collect, store, and process categories of data depending upon the relationship we have with you. We may collect and use the following personal information about you:

Members of the public

  • Name
  • Email address
  • Details of any enquiries you submit, potentially including special category data (see below)
  • Information about how you use our website and records of our communications

Clients/Potential Clients

  • your name and contact information, including address, email address and telephone numbers
  • Details of any enquiries or information you voluntarily submit, potentially including special category data (see below)
  • Information about how you use our website and records of our communications
  • Details of your attendance at any of our events
  • Any other information that may identify you that you voluntarily provided to us potentially including special category data
  • Contracts details of loanee and previous owners for of the loan of and temporary holding of artworks
  • Contact details for the previous owner of donations of artworks, including purchase information
  • Contact details of representatives

Artists/Potential Artists and their Representatives (Paid or Voluntary)

  • Your name, address and contact information, including address, email address and telephone numbers
  • Identification and other documentation (such as passport, proof of address, dbs) for eligibility to work
  • Biography and history of your works
  • Financial details, transactions, and payment information
  • Information about how you use our website and records of our communications
  • Details of your attendance at any of our events
  • Details of any enquiries or information you voluntarily submit, potentially including special category data (see below)
  • History of conversations with you
  • Copyright permissions and contracts

Visitors to website

  • Cookies to get a better understanding of the use of our website

Visitors to our galleries

  • CCTV Images of you

Special Category Data

Special Category Data is defined as information in relation to an individual’s – racial or ethnic origin; religion; political views; trade union membership; genetics and biometrics (where used for ID purposes); health and disabilities or sex life and sexual orientation. The following Special Category data could be processed:

To respond to queries in which you have submitted special category data that relates to your own circumstances, to respond to your query.

To enable us to make suitable arrangements for you to register for, attend or participate in an event.

For equal opportunities monitoring

4. Why we process your data and the lawful basis for processing

We may process your personal data for any of the following purposes:

  • Responding to general enquiries
  • Facilitate art exhibitions and events
  • Updating and enhancing client and artists records
  • Statistical analysis to help manage our business
  • Where it is necessary to comply with professional, legal and regulatory obligations that apply to our business, such as tax, money laundering, health and safety or safeguarding regulations
  • Marketing our artworks, artists, events, and services
  • Managing the loan of artworks to third parties
  • Managing our artworks provenance records.

The first principle of the General Data Protection Regulation (GDPR) requires that whenever an organisation processes personal data, it must be processed ‘lawfully, fairly and in a transparent manner’. This requires is to identify a lawful basis under Article 6 GDPR and Article 9 GDPR for special Category Data. The following lawful basis have been identified in order for us to process your personal data:

ArticleDescription
6(1)(a)With your consent to process your data, for example if you engage with a specific service. Where we rely on consent this will be made clear to you and you are free to decide whether to provide this data with no consequences if you choose not to.
6(1)(b)Processing is necessary for the performance of our contract with you as a registered student (or to enter into a contract). Without this information we would not be able to process your data to provide the contracted services or provide the support necessary to fulfil that contract.
6(1)(c)Some processing is necessary to because we have a Legal obligation to do so, for example for the prevention and detection of crime or fulfil our statuary compliance and regulatory obligations.
6(1)(d)To protect your vital interests or those of another person, where you are physically or legally incapable of giving consent
9(2)(a)With your explicit consent to process special category data your data. Where we rely on you are free to decide whether to provide this data. There will be no consequences if you choose not to and you may later withdraw consent.
9(2)(c)To protect you vital interests or those of another person, where you are physically or legally incapable of giving consent, for example we may share health related information.
9(2)(f)Where processing is necessary in relation to legal claims.
9(2)(g)We may need to process special category data if the processing is necessary in the substantial public interest and there is a basis to do so in law
9(2)(j)We may process special category data for archiving, scientific or historical research purposes or statistical purposes, where there is a basis to do so in law

5. How do we keep your Personal Data Secure? 

We have implemented appropriate physical, technical, and organisational security measures designed to secure your personal data against accidental loss and unauthorised access, use, alteration, or disclosure. We limit access to personal data to those employees, agents, contractors, and other third parties that have a legitimate business need for such access.

6. Sharing your Personal Data with Third Parties

We utilise many different storage solutions and IT systems, some of which are outsourced to third party providers. Where processing takes place with an external third party, processing takes place under an appropriate agreement outlining their responsibilities to ensure that processing is compliant with the Data Protection legislation and verified to be secure

Where required, we may share personal information with:

  • Third parties we use to help deliver our artwork, services, events or exhibitions, for example, delivery companies, insurance brokers, event or fair organisers/suppliers
  • Other third parties we use to help us run our business, for example, marketing agencies, website hosts or administrative/audit functions
  • Our insurers and brokers (if applicable)
  • Our bank, (if applicable)
  • We may disclose and exchange information with law enforcement agencies and regulatory bodies to comply with our legal and regulatory obligations.

7. How Long will your Personal Data Held?

We will retain your data for as long as it is required to fulfil the purpose for which is it held and then to fulfil any legal requirements or to respond to any complaints or claims made by you or on your behalf. Different retention periods apply for different types of personal information or the different relationships and transactions we may have processed your data for, but these are summarised below as:

Record TypeHeld for
EnquiriesUntil enquiry has been answered
Event booking and attendance6 years after the end of the relationship
Client records6 years after the end of the relationship
Artists and their representatives (paid or voluntary)6 years from last contact
Record of Artists in permanent collections99 Years
Provenance records or artworks99 Years

8. What Are Your Rights Under GDPR

GDPR provides individuals a number of rights in relation to the processing of personal data, each of which may apply to differing degrees’ dependent upon the nature of the processing and the legal basis for it. You have the right to:

In certain circumstances, you may also have the right to: 

9. Data Protection Officer (DPO) Contact Details

Our Data Protection officer is Duncan James. To exercise your rights, or if you wish to raise a concern about our processing of your data, please contact the DPO on +44 (0)191 243 7357 or via email at dp.officer@northumbria.ac.uk.

10.  Lodging a Complaint with the Information Commissioners Office (ICO)

If you are dissatisfied with our processing of your data, or a response to a complaint you have made to us, you have the right to complain to the ICO via Telephone: 0303 123 1113 (local rate) or 01625 545 745, via email: casework@ico.org.uk or for more information see Information Commissioner’s web site.