The RA is an independent charity that exists to champion art and artists – a mission we pursue through exhibitions, education and debate. To fulfil this mission, we engage with the public in a variety of ways, many of which involve you sharing your personal data with us. For example, when you book a ticket online, become a member, purchase something from our online shop, visit our website or make a donation.

This data helps us to deliver exceptional exhibitions, events, services and products by allowing us to understand how you interact with and enjoy what we offer. Sharing your data also enables us to provide you with more tailored and relevant information to help you get the most from your experience of the Royal Academy of Arts.

Our privacy policy and guiding principles set out the ways we will manage your data – respectfully and responsibly and in line with our legal obligations.

1. We put the safeguarding of your data at the centre of everything we do
   
2. All personal data is managed respectfully and responsibly
   
3. When we communicate with you, we aim to always send information that is relevant and appropriate
   
4. We are proactive about managing your privacy, making sure the way we look after your personal data is secure and legally compliant

What this policy covers

The Royal Academy of Arts is committed to protecting your personal information, whether you are a visitor, ticket-buyer, Friend, Patron, shopper or other supporter. It is our aim to put our customers and supporters and the safeguarding of their personal data at the centre of everything we do and manage your personal data respectfully and responsibly.

This Policy explains how the RA, and its associated group companies (listed below), collect, manage and use the personal information you provide to us, whether online, via phone or in person, email, in writing or any other correspondence. If you are a Friend or Patron of the RA, or a member of the Academicians’ Room, your membership terms and conditions will also set out how we will use your personal information.

We ensure that we use your personal data in accordance with all applicable laws concerning data protection and personal information.

This Policy explains:
- Who we are;
- What personal data we collect;
- How we may use your data;
- How we may contact you;
- How we will store and protect your data;
- The circumstances in which we share your data with third parties;
- What you should do if you would like us to change or delete the data we hold for you or stop contacting you;
- How to make a complaint;
- Changes to this Privacy Policy.

Who we are

The Royal Academy of Arts exists to promote art and artists – a mission we pursue through exhibitions, education and debate. All parts of the RA, from the RA Schools and the Summer Exhibition to our visitors, Friends and Patrons, the RA Shop and its art sales and our other commercial endeavours, support the RA in this mission.

The RA is a registered UK charity (with charity number 1125383). We are also a registered company limited by guarantee in England and Wales, with registration number 06298947.

R. A. Enterprises Ltd (company number 01666333), the Friends of the Royal Academy (charity number 272926, company number 01291535), the Royal Academy Development Trust (charity number 1067270), RA (Arts) Limited (company number 02836364) and Burlington House Ltd (company number 2216104) are all either wholly owned subsidiaries of the RA which trade on its behalf, or are associated charities to the RA and whose objects are to support the RA. In this policy, “we” and the term “across the RA” means both the RA and these RA companies and charities.

NHS Test and Trace

The easing of social and economic lockdown measures following the Covid-19 outbreak is being supported by NHS Test and Trace. Find out more about this service.

The RA will assist the Test and Trace service by keeping a record of visitors and providing that data to NHS Test and Trace if needed. In order to achieve this, in addition to the information detailed in the remainder of this policy, the RA will:

1 – Gather some or all of the following data on visitors and Friends (this may take place automatically as part of your engagement with the RA, for example when booking a ticket):

a. Name
b. Membership number
c. Number in group of visitors
d. Household grouping details
e. Contact telephone number
f. Date of visit
g. Arrival time
h. Departure Time

2 – Store this data for a minimum of 21 days (where data gathered purely for NHS Test and Trace, and are not required for other business purposes, the data will be disposed of after 21 days);

3 – Provide this data to NHS Test and Trace, upon request. All data gathered for this purpose will be stored and protected in accordance with the measures set out in this policy.

What personal data we collect

We may collect personal information about you when you engage with us for a number of reasons including when you book or buy a ticket, become a member, enquire about our activities and services, engage with our social media, make a donation, sign up to receive emails, create an online account, purchase something from us, register for an event, enter the Summer Exhibition or loan a work of art to us, or otherwise provide us with personal information that may be used by the RA to deliver its charitable services, enable us to provide a service to you or to enhance your experience with us.

This can include information such as your name, postal address, email address, phone number, age, bank details and credit/debit card details. If you purchase something from us, we may in some circumstances have to collect more extensive information from you, for anti-money laundering purposes. That can include seeing your photo ID and proof of address. In some circumstances we will have an obligation to keep the information we hold about you up to date.
Where you have made a donation to us, we will also ask you if you are a tax payer and would like us to claim gift-aid on your donation, and record this information so that we can claim the gift-aid. We will also record where you tell us not to claim gift aid.

In addition to your personal data, we may also ask for your preferences so that we can send you information that is tailored to your interests.

On occasion, we may receive information about you from third parties, for example if we have run a joint competition with a third party or we have received a personal recommendation that you may be interested in the work of the RA.

We do not usually collect ‘sensitive personal data’ from you unless there is a clear reason for doing so, such as where we need this information to ensure that we provide appropriate facilities or support, to enable you to enjoy everything we offer across the RA. Examples of sensitive personal data we may hold would be in relation to the courses and classes we run for people with dementia.

Potential new supporters and donors
We may collect information on potential supporters or donors who might be interested in becoming involved or increasing their involvement with the RA (for example publicly available information on art collectors, philanthropists or people with a public profile, from such sources as Debrett’s or Larry’s List), but will only do this where we have a legitimate interest and have carried out a legitimate interest assessment or and/or a privacy impact assessment as required (see below).

Website users
We may also gather information about you from your use of our website, such as which pages are most visited and which events or facilities are of most interest. We will use this information to improve our website and to ensure we provide the best services for our users. Wherever possible we use aggregated or anonymous information which does not identify individual visitors to our website. By submitting your details, you enable us (and where applicable any suppliers we use) to provide you with the goods, services, information, activities or online content you select and any other related services the RA may provide.

The RA website uses cookies to help our website work well and to track information about how people are using it. More information on cookies and how to control the cookies we use can be found on our cookies page on our website. For the Royal Academy shop, we use cookies in a different way. Specific information regarding cookies on our shop site can be found here.

If you register on our website then the following will also apply:

• The website will collect personal information when you register with us;
• The website will collect such information as your name, email address and post code. Once you register with the website you will not be anonymous to us when you subsequently sign in;
• You endeavour to ensure that any registration information you give to the RA will always be accurate, correct and up to date;
• We collect and retain information about your transactions with us so that we can process your transactions and deal with future queries;
• Through the use of cookies, we will receive information from your computer such as your IP address (the unique number that identifies your computer when you use the internet) and we may record this information to provide you with a good experience when browsing our website or to improve the functionality of our site.

Job applicants
If you apply to work at the RA, we will only use the information you give us to process your application and to monitor recruitment statistics. If we want to disclose information to someone outside the RA, for example, if we need a reference, we will make sure we tell you beforehand, unless we are required to disclose this information by law.

If you are unsuccessful in your job application, we may hold your personal information for up to 12 months after we’ve finished recruiting for the post you applied for. After this date we will destroy or delete your information. We keep de-personalised statistical information about applicants to develop our recruitment processes, however no individual applicant would be identifiable from this information.

If you commence employment with the RA, your data will be processed in accordance with your employment contract and our other applicable policies.

RA Schools applicants, students and alumni
If you apply to be a student at the RA Schools, we will only use the information you give us to process your application and to monitor applicants’ statistics.

If you are unsuccessful in your application, we will securely archive the information you have provided to us after we have finished the selection process.

If you are successful and enrol as a student of the RA Schools, we will use your data for the purposes of your studentship and will keep your data as a record of our RA Schools students. On graduating from the RA Schools, you will then become part of our RA Schools alumni and we will contact you in relation to alumni and RA Schools activities, unless you tell us you would rather not hear from us.

Under 16’s
We are committed to protecting the privacy of the young people who engage with us through our website, our events and our courses and classes. When we collect data about a child or young person aged under 16, we will make it very clear as to the reasons for collecting this data and how it will be used. If you are under 13 we will ensure we have consent from a parent or guardian.

Your debit card and credit card information
If you use your credit or debit card to donate to us, buy something or pay for a ticket or membership online or over the phone, we will ensure that this is done securely and that we will not keep your details for longer than necessary for the purposes of the transaction.

How we may use your data

We may use your personal data for a number of purposes, including the following:
• To provide you with the services, products or information you have requested from us. This could include fulfilling sales contracts you have entered into with us, or servicing your membership with us. It may also include providing you with information in your membership communications about exhibitions, offers and art related news outside the RA, which we think may be of interest to you.
• To provide you with information by email which we feel may interest you and where you have given your consent to be contacted by email. This may include requests for your support (please refer to How We May Contact You).
• To provide you with information about our work or our activities by post where we have a legitimate interest in sending it to you. Again this may include requests for your support.
• To telephone you if you have provided us with your telephone number and have not registered with the Telephone Preference Service.
• To process a donation we may receive from you and to communicate with you in regard to the donation (this could include asking you whether you would like to sign a gift-aid declaration to allow us to claim gift-aid on your donation);
• To create an account for you if you register with us.
• For customer service or administrative purposes (for example we may contact you regarding a donation you have made or an event you have registered or booked a ticket for).
• For internal record keeping, including the management of any feedback or complaints.
• To target communications and messages to you and to identify similar groups of prospective customers.
• To assess our customer base, including how they interact with us, visit our exhibitions and use our campus, and what parts of the RA they are interested in.
• To compile briefing notes for our staff about guests in advance of meetings, dinners and other events at which supporters and potential supporters may be present.
• To track user visits to our website and record navigation across our website and in addition to track whether our emails are opened and read.
• To invite you to participate in surveys or research.
• To use IP addresses to identify your approximate location, to block disruptive use, to record website traffic or to personalise the way our information is presented to you.
• To analyse and improve the services we offer.
• Where it is authorised by law.
• To protect against and prevent money laundering.
• We may assess your personal information for the purposes of credit risk reduction or fraud prevention.

Inappropriate website content
If you post or send any content that we believe to be inappropriate, offensive or in breach of any laws, such as defamatory content, we may use your personal information to inform relevant third parties such as your internet provider or law enforcement agencies.

How we may contact you

By email
If possible, we would like to be able to contact you by email because we feel it is the most efficient and productive way to communicate with you about the wide range of programmes and offers from across the RA.

We will contact you by email if you have given us your email address and we are emailing you to provide the services you have requested.

We may also contact you by email if you have bought a service or goods from us and we want to contact you about similar goods or services.

We may in addition contact you for marketing purposes by email if you have given us your consent to do so. This may include requests for your support through a variety of different fundraising initiatives such as requesting donations, inviting you to attend special events, or encouraging you to purchase tickets or products.

If you enter your contact details into one of our online forms, we may use this information to contact you, even if you don’t click ‘submit’ on the form, but we will only do this to see if we can help with any problems you might be experiencing with the form or with our website.

By text
We may send you service communications via text, for example where you placed an order for goods or services on our website, or you have given a donation by text.

By post and telephone – where we have a legitimate interest to contact you
If you have provided us with your postal address or telephone number we may send you direct mail or telephone you about our work and our fundraising campaigns, unless you have told us that you would prefer not to receive such information. We will carry out a legitimate interest assessment to ensure that we are satisfied that you would reasonably expect such communications from us and would not consider it to be intrusive. For example, we may want to post you an invitation to an event we think you may be interested in.

Before telephoning you (unless it is in connection with the service we are delivering to you) we will check with the Telephone Preference Service.

We consider that we have a legitimate interest in furthering the charitable aims of the RA by engaging the public in the exhibitions and experiences we offer so that we can promote and educate in art in all its forms. In order to do so, we need to be able to tell people about our work and to raise funds by donations and sponsorships or through our commercial activities, for example, the RA Shop.

If you have not given us your data yourself and we have not received it from a third party, we will only contact you if you fall into one or more of the categories below:
• You are a known philanthropist or connected with a trust or foundation, and/or
• You are a known art lover, collector or involved in art or art education, and/or
• You are a publicly recognisable figure.

If we have a legal obligation to process your data
In addition to the above, we may have a legal obligation to process your data, for example in order to carry out due diligence if you are a prospective donor or sponsor, or you are interested in making a particular purchase.

Business to business communications
If we are communicating to you on a ‘business to business’ basis we will contact you by post or email, unless you have let us know that you would prefer us not to do so.

How we will store and protect your data

We will either store your data on our own servers or in the Cloud. Where we transfer your data outside the UK, we will ensure that: the country where the data is transferred to is within the European Economic Area (EEA); or the country has been deemed to provide an adequate level of protection for personal data by the European Commission; or we use specific contracts approved by the European Commission which give personal data the same protection it has in Europe, combined with appropriate due diligence; or a specific legal exception applies. We will take all reasonable steps to ensure that your data is kept secure, including encryption, network level protection, strong password policies and dual authentication.

Keeping your personal data

We keep your personal data for as long as required to operate the service we are providing to you or for archival purposes and in accordance with legal requirements and tax and accounting rules. If we have not heard from you or you have not engaged with us for a period of two years and we do not need to keep your personal data for archival, legal or business reasons, we will delete or suppress your personal information. Where your information is no longer required, we will ensure it is disposed of in a secure manner.

If you have told us that you do not want to hear from us at all or by a particular channel, we will hold the minimum amount of your personal data on a suppression list to ensure we comply with your request.

The circumstances in which we share your data with third parties

The RA may share your data with the other RA entities, suppliers or service providers to provide the products or services you’ve requested from us, for example, we may use a separate company to deliver goods to you. Other instances where we may share your data would be for payment processing, mailing houses, database services or website hosting.

If you have chosen to take part in a competition or an activity the RA is running jointly with a third-party organisation, you will be asked if your data can be shared with these third parties.

We may also share data with such online engines as Google, Facebook and other third parties, to help us to identify customers who are similar to our audiences, target the adverts that we serve, and ensure they are relevant to new and existing customers. However, we will only do so if we are satisfied that your personal data is secure and will not be used for any other purpose. The personal data shared for these purposes is pseudonymised to protect it.

We may disclose your personal information to a third party if we are under a duty to disclose your personal data in order to comply with any legal obligation (for example to government bodies and law enforcement agencies), or in order to enforce or apply our rights (including in relation to our website or other applicable terms and conditions) or to protect the RA, for example in cases of suspected fraud or defamation. This may also include CCTV footage.

We may disclose your personal information to a third party in order for them to rely on the money laundering client due diligence checks that we have carried out. This is done in order to reduce the number of times that you have to undergo due diligence checks.

Links
This Policy applies to all data we collect from across the RA, including our website. If a link on this website takes to you to the website of a third party you should refer to the privacy policy relating to that website to understand how your personal information is managed by that third party or how they use cookies. We cannot accept any responsibility or liability for the privacy practices of such third-party websites and your use of such websites is at your own risk.

What you should do if you would like us to change or delete the data we hold for you, or stop contacting you

Do you want us to stop contacting you?
It is your choice as to whether and how you want to receive information about us and our work, and the ways you can get involved. You have the right at any time to ask us to amend or stop using your personal information, including for marketing purposes.

You may opt out of marketing emails at any time by clicking the ‘unsubscribe’ link in our marketing emails. You can also change any of your marketing preferences at any time (including telling us that you don’t want us to contact you for marketing purposes by telephone or send you direct marketing by post) by contacting our Customer Services Team on 020 7300 8090 or DataProtection@royalacademy.org.uk. We will not use your information for marketing purposes if you have indicated that you do not wish to be contacted for such purposes. However, we will retain your details on a suppression list to help to ensure that we do not continue to contact you.

Do you want to change the details we hold for you?
The accuracy of your information is important to us. You can edit your RA account information, including your address and contact details at any time. If you would like to change your preferences or update the details we hold about you, please contact our Customer Services Team on 020 7300 8090 or DataProtection@royalacademy.org.uk.

Do you want to request a copy of the information we hold for you? You have a right to request a copy of the personal information we hold about you and to have any inaccuracies corrected or your data erased. You also have a right to data portability.

If you would like to make a request for this data (a Subject Access Request) we require you to prove your identity with two pieces of approved identification for these purposes. Please address requests to Head of Data Integrity, The Royal Academy of Arts, Piccadilly, London, W1J 0BD or email DataProtection@royalacademy.org.uk. We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated. Please provide as much information as possible about the nature of your contact with us to help us locate your records. You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we could refuse to comply with your request in these circumstances.

How to make a complaint

If you would like to make a complaint about any aspect of this Policy, please contact Data Manager, Fundraising & Membership, The Royal Academy of Arts, Piccadilly, London, W1J 0BD or email DataProtection@royalacademy.org.uk.

The Information Commissioner’s Office
You have the right to lodge a complaint with the supervisory authority responsible for all information matters, The Information Commissioner’s Office at www.ico.org.uk.

Changes to this Privacy Policy

We may update the terms of this Policy at any time, so please do check it from time to time. We will notify you about significant changes in the way we treat personal information by sending a notice to the primary email address you have provided to us or by placing a prominent notice on our website. By continuing to engage with us through our services and our website you will be deemed to have accepted such changes.