Privacy Notice

Serpentine Galleries are subject to English data protection legislation in respect of the personal information you submit to us, or which we collect.

1. Who we are

This website is operated by Serpentine Galleries. Serpentine Galleries is referred to in this privacy notice (“Privacy Notice”) as “us” or “we” and you can contact us using the details set out in paragraph 12 below. In this policy we describe the types of personal data which we collect and the uses which we make of it.

For the purposes of applicable data protection laws, including the UK General Data Protection Regulation (“UK GDPR”) , Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (“DP Laws”), Serpentine Trust is the data controller. We are registered in England and Wales under company number 2150221. Our registered office is at The Serpentine Gallery, Kensington Gardens, London, W2 3XA, United Kingdom. You can contact our data protection officer (“DPO”) by using the details in paragraph 12 below.

2. What is personal data?

Personal data includes all information held in electronic form or manually in a structured filing system relating to a living individual who can be directly or indirectly identified from that data (or from that data and other information in our possession) and includes personal contact information and images, such as from CCTV.

3. What personal data do we hold?

We hold personal data which you provide to us – for example;

Supporters / Donors

If you support us, for example make a donation, buy something from our shop, or purchase tickets for an event, we will usually collect:

Contact Details

• Name
• Address
• Phone numbers
• Email address
• Date of birth
• Bank or credit card details
• Gift Aid status (for donations)

Interests / Events

• Information you provide us about your interests, including the type of news stories you are interested in.
• A record of the events you have attended

Website and Communication Usage

• How you use our website and whether you open or forward our communications, including information collected through cookies and other tracking technologies (refer to our  Cookie Policy).

If you are attending a Serpentine Galleries event we may also ask you about your access requirements, dietary preferences, your family and spouse/partner details (if they are attending with you).

Newsletter sign-up

If you sign up to receive our newsletter, we will usually collect:

Contact Details

• Name
• Email address

Interests / Events

• Information you provide us about your interests, including the type of news stories you are interested in.

Visits to our site

When visiting our site, we may automatically collect the following information:

• technical information, including:
• the Internet protocol (IP) address used to connect your computer to the Internet
• your login information
• browser type and version
• time zone setting
• browser plug-in types and versions
• operating system and platform
• information about your visit, including:
• the full Uniform Resource Locators (URL) clickstream to, through and from our site (including date and time)
• products you viewed or searched for
• page response times
• download errors
• length of visits to certain pages
• page interaction information (such as scrolling, clicks, and mouse-overs), and methods used to browse away from the page and any phone number used to call our customer service number.

Cookies

Our website uses cookies to distinguish you from other users of our website. This helps us to provide you with a good experience when you browse our website and also allows us to improve our site. For detailed information on the cookies we use and the purposes for which we use them see our Cookie policy https://www.serpentinegalleries.org/legal.

In addition, we may collect the following personal data from other sources:

We may receive information about you if you use any of the other websites we operate or the other services we provide. We are also working closely with third parties including, for example, artists, sub-contractors in technical, payment and delivery services, advertising networks, analytics providers, search information providers and may receive information about you from them.

We may also combine information from other sources with the information you have provided us with the aim of understanding our audiences and delivering the highest quality experience of the Serpentine Galleries.

The sort of information we obtain from these sources might include details of other charities you may support and indicators of your leisure interests and financial status.

Where we use this data, we will always ensure that we are entitled to by reviewing the privacy notice of that third party to ensure that it informs people that their data may be passed to us.

4. Purposes for which personal data is used

We use your personal data for the following purposes:

• Ensure we know how you prefer to be contacted
• We use your personal information to provide you with the information, services, or products you ask for. 
• We may also use your personal information for other purposes which we specifically notify you about and, where appropriate, obtain your consent. 
• To ensure that you receive relevant and personalised communications, we will use your data to create an individual customer profile. This may include data you have provided, or which is generated by your use of Serpentine Galleries information, for example contact details, preferences, donor history, and online behaviour.
• To allow you to participate in interactive features of our service, when you choose to do so
• To measure or understand the effectiveness of advertising we serve to you and others, and to deliver relevant advertising to you;
• To make suggestions and recommendations to you and other users of our site about goods or services that may interest you or them.

We will not use any of your personal data for automated decision making.

Building profiles and targeting communications

We use profiling techniques to ensure communications are relevant and timely, and to provide an improved experience to our supporters and visitors. Profiling also allows us to target our resources effectively.

We do this because it allows us to understand the background of the people who support us and helps us to make appropriate requests to supporters. Importantly it enables us to provide you with communications that are better suited to you while raising more funds, sooner, and more cost-effectively, than we otherwise would. 

When building a profile, we may analyse geographic, demographic and other information relating to you in order to better understand your interests and preferences in order to contact you with the most relevant communications.  In doing this, we may use additional information from third party sources when it is available.  Such information is compiled using publicly available data about you, for example Companies House, listed Directorships or typical earnings in a given area. All this type of profiling is done under our internal processes and procedures that ensure we have the correct permissions to do so.

We may also use this information to help us determine whether and in what ways you might be interested in getting involved in our other fundraising activities.

5. Our legal bases for processing your data

We are entitled to use your personal data for these purposes because one or more of the following legal bases applies:

1. your consent, e.g., when you subscribe to our newsletter or request to receive marketing from us and our third parties. Note that you can withdraw this consent at any time;
2. to take steps to enter into or perform a contract with you or other individuals, e.g., to carry out our obligations arising from any contracts entered into between you and us;
3. compliance with our legal obligations;
4. in order to establish, exercise or defend our legal rights or for the purpose of legal proceedings; or
5. ours or our third parties’ legitimate interests, where these are not overridden by your privacy and data protection rights. We use your personal data, as permitted by the DP Laws, where necessary for the following legitimate business interests:

• Supporter care – to respond to enquiries.
• We use your personal information to claim Gift Aid on your donations. 
• We use your information to keep a record of your relationship with us and for internal administrative purposes (such as our accounting and records), and to let you know about changes to our services or policies.
• To administer our site and for internal operations, including troubleshooting, data analysis, testing, research, statistical and survey purposes.
• To improve our site to ensure that content is presented in the most effective manner for you and for your computer.
• As part of our efforts to keep our site safe and secure.
• Where we contact members of the press, professional networks, or our development supporters to share information relevant to their professional relationship with Serpentine Galleries. In these cases, we use data in ways that people would reasonably expect –  such as sending invitations to previews or events, press announcements, or updates about our programme and partnership opportunities. We carefully assess the balance between our legitimate interests and your privacy rights before doing so.

6. Disclosure of personal data to third-parties

We will not sell your details to any third parties, but we may sometimes share your information with our trusted service providers who are authorised to act on our behalf, our trading companies, and associated organisations who work on our behalf, or whom we work with in partnership.

The service providers we use may have access to your personal data. These third-party vendors collect, store, use, process and transfer information about your activity on our service in accordance with their privacy policies.

Our service providers are sometimes based outside of the UK and/ or European Economic Area (“EEA”), in these instances we will work to make sure their operations are in accordance with DP Laws.

The selected third parties include:

• Business partners, suppliers and sub-contractors for the performance of any contract we enter into with you.

• Advertisers and advertising networks that require the data to select and serve relevant adverts to you and others. We do not disclose information about identifiable individuals to our advertisers, but we may provide them with aggregate information about our users (for example, we may inform them that 500 men aged under 30 have clicked on their advertisement on any given day). We may also use such aggregate information to help advertisers reach the kind of audience they want to target (for example, women in SW1). We may make use of the personal data we have collected from you to enable us to comply with our advertisers’ wishes by displaying their advertisement to that target audience.

• Analytics and search engine providers that assist us in the improvement and optimisation of our site, including Google Analytics. Google Analytics is a web analytics service offered by Google that tracks and reports website traffic. Google uses the data collected to track and monitor the use of our Service. This data is shared with other Google services. Google may use the collected data to contextualise and personalise the ads of its own advertising network. You can opt-out of having made your activity on the Service available to Google Analytics by installing the Google Analytics opt-out browser add-on. The add-on prevents the Google Analytics JavaScript (ga.js, analytics.js and dc.js) from sharing information with Google Analytics about visits activity. For more information on the privacy practices of Google, please visit the Google Privacy Terms web page: https://policies.google.com/privacy

• If we are under a duty to disclose or share your personal data in order to comply with any legal obligation, or in order to enforce or apply our terms of use https://www.serpentinegalleries.org/legal and other agreements; or to protect the rights, property, or safety of the Serpentine Galleries, our customers, or others. This includes exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction.

NHS Test and Trace

We have a responsibility to share your contact details with the NHS Test and Trace service if required, as a result of someone who has tested positive for COVID-19 having listed the galleries as a place they recently visited, or because the galleries have been identified as the location of a local outbreak of COVID-19. NHS Test and Trace provide assurance that they will only ever use the data provided to them for this specific public health purpose, and that they will handle the data in line with the highest ethical and security standards.

Other artistic organisations and venues

We work with other trusted artistic organisations and venues to share our work with the widest possible audience and many of our live programmes are held offsite. Serpentine Cinema, for example, is held at Peckhamplex Limited and event registration is run through their website. In these instances, you are subject to their privacy policy, cookies policy and terms & conditions.

7. Retention of personal data

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. Accordingly, except in respect of provenance data, we use the following criteria to determine the period for which we retain your personal data:

• the period for which the personal information is required for the applicable purposes set out in this Privacy Notice; or
• any statutory limitation period relevant to the personal information; or
• any statutory or regulatory retention period applicable to the personal information.

8. Access and control of personal data

In certain circumstances, you have the following rights under DP Laws:

• confirm whether we process your personal data and to obtain information regarding the processing of your personal data and access to your personal data that we hold;
• receive a copy of some personal data in a structured, commonly used and machine-readable format and/or request that we transmit that data to a third party where this is technically feasible;
• request rectification of inaccurate personal data;
• right to request that we restrict, anonymise or block processing of your personal data;
• request erasure of your personal data (subject to legal retention requirements);
• objecting to the processing of your personal data; and/or
• Where consent was provided for certain processing activities, withdraw their consent to the collection, processing, use and/or disclosure of their personal data at any time. Please note that this will not affect the lawfulness of any collection, processing, use or disclosure undertaken before such withdrawal and that we may still be entitled to process the personal data if it has another legitimate reason (other than consent) or a consent exception for doing so.

Please note that if you do not provide certain personal data to us when requested (and where relevant, provide your consent) when the provision of personal data is a statutory or contractual requirement, we may not be able discharge such obligations.

You also have the right to lodge a complaint with the UK data supervisory authority, the Information Commission if you think any of your rights have been infringed by us.

Requests can be made by contacting us using the details set out in section 12 below.

9. How do we keep your personal information safe?

We ensure that there are appropriate technical controls in place to protect your personal details. For example, our online forms are always encrypted and our network is protected and routinely monitored.

We undertake regular reviews of who has access to information that we hold to ensure your information is only accessible by appropriately trained staff on a ‘need to know’ basis and for the communicated purposes only.

Although data transmission over the Internet or website cannot be guaranteed to be secure, we and our business partners work hard to maintain physical, electronic and procedural safeguards to protect your information in accordance with applicable data protection requirements.

All information you provide to us is stored on our secure servers. Any payment transactions will be encrypted (using SSL technology). Where we have given you (or where you have chosen) a password which enables you to access certain parts of our site, you are responsible for keeping this password confidential. We ask you not to share a password with anyone.

International Transfers of Personal Data Outside UK/EEA

The data that we collect from you may be transferred to, and stored at, a destination outside the UK and/ or the EEA. It may also be processed by staff operating outside the EEA who work for us or for one of our suppliers. Such staff maybe engaged in, among other things, the fulfilment of your order, the processing of your payment details and the provision of support services. If we transfer personal data to a third party outside of the UK or EEA, we will, as required by DP Laws, ensure that your data protection rights are protected by appropriate safeguards, such as the UK IDTA or the European Commission’s Standard Contractual Clauses for the transfer of personal data to controllers or processors established in third countries. We will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this Privacy Notice. Please contact us (using the information in paragraph 12 below) if you would like more information about these safeguards

Secure shopping

The payment card information you supply to us for any online transaction is used solely for the purpose of processing that transaction.

We have partnered with Shopify, a leading payment gateway to accept credit cards and electronic check payments safely and securely for our customers. Shopify manages the complex routing of sensitive customer information through credit card processing networks.

The company adheres to strict industry standards for payment processing, including:

• 128-bit Secure Sockets Layer (SSL) technology for secure Internet Protocol (IP) transactions.
• Industry leading encryption hardware and software methods and security protocols to protect customer information.
• Compliance with the Payment Card Industry Data Security Standard (PCI DSS).

10. Photography, Videography and sound recording

In this Privacy Notice, use of the term ‘photos’ covers the use of video footage and sound recordings also.

Serpentine might take photos to document our buildings, exhibitions, live programmes, public art or fundraising events.

Promotion of our work

Serpentine’s purpose is to open up art, for everyone, for free, to do this we need to promote our exhibitions, buildings, activities and facilities and the processing of personal data in photos is in this interest. We may take photos across a range of activities and use them across our digital channels, printed media and internal presentations. Where photos are taken for this purpose we will make it clear to you and where possible will use a permission form to ensure you have been able to speak to us about your photo.

We may also retain photography, video footage and sound recording as a historical record.

Marketing, media and sharing:

• We take photos/recordings for specific purposes such as (but not limited to) for use on:
• Serpentinewebsite
• Serpentine social media channels
• Serpentine internal presentations
• Printed and online publications
• Marketing materials such as flyers and advertising campaigns
• Emails
• Fundraising purposes such as funding websites and applications

Third parties

We may like to share the photos with a third party such as for press releases, for any traditional and digital media platforms such as newspapers, magazines, online news websites or applications etc. In this instance we would securely share your photos with the party, stating they can only be used to publicise Serpentine and nothing else. Responsibility for that photo would then lie with that third party.

11. Marketing

Depending on your preferences, we may send you marketing communications where we think that these are relevant and interesting. We send emails to your provided email address, such as our newsletter or our brochures. Some of these emails may be tailored to you, based on your interests and any other information we may hold.

We also send you information through the post, such as our newsletter and our brochures, and if you have provided your phone number we may contact you by telephone for the purposes for which you have provided this (e.g., to keep you updated on our developments).

If you no longer wish to receive marketing communications from us (or would like to start receiving marketing communications), you can change your preferences (‘opt-out’) at any time by writing to us or emailing us (using the information in paragraph 12 below). You can also click the ‘unsubscribe’ button which is included in the emails we send you, or you can tell us over the phone not to call you anymore. We may continue to send you service related emails if you optout of marketing, such as information about our service and information about your legal rights/conditions of use of the service.

You may also see ads for our website on third-party sites, including on social media. These ads may be tailored to you using cookies (which track your web activity, so enable us to serve ads to customers who have visited our Website). Where you see an ad on social media, this may be because we have engaged the social network to show ads to our customers, or users who match the demographic profile of our customers. If you no longer want to see tailored ads you can change your cookie and privacy settings on your browser and these third-party websites.

Your option not to receive promotional and marketing material shall not preclude us from corresponding with you, by email or otherwise, regarding your relationship with us (e.g., your account status and activity or our responses to questions or inquiries you pose to us); shall not preclude us, including our employees, contractors, agents and other representatives, from accessing and viewing your personal data for our internal business purposes; and shall not preclude us from disclosing your personal data as described in this Privacy Notice for purposes other than sending you promotional and marketing materials.

12. How to contact us

If you have any questions about our use of your personal data, please contact us using the details below:

Attn: The Data Protection Office

Address: Serpentine Galleries, Kensington Galleries, London, W2 3XA

E-mail: [email protected]

13. Links to third-party websites

Please note that this website may contain links to other third-party websites. These third-party websites are not subject to this Privacy Notice, and we recommend that you check the privacy and security policies of each website that you visit. We are only responsible for the privacy and security of the personal data that we process as a data controller and have no responsibility for the actions of other third party data controllers in relation to your personal data.

Changes to this policy

We may update this Privacy Notice from time to time to reflect changes to our usage of personal data.