The policy aims to cover all of your rights, and the information required under all applicable Data Protection laws, including the General Data Protection Regulations (GDPR), and the new Data Protection Act 2018, as well as anticipated regulations. We are continually working to improve our systems, processes and practices, and will update this policy as necessary.
It is important that the personal data we hold about you is accurate and current. Please keep us informed at firstname.lastname@example.org if your personal data changes during your relationship with us.
Who are we?
The V&A is the world's leading museum of art, design and performance.
It is a public body linked to the Department for Culture, Media and Sport, and it is a charity exempt from registration under the Charities Act of 2011. It is governed by a Board of Trustees appointed by the Prime Minister.
The V&A is supported by:
● a trading company, V&A Enterprises, which is the business face of the museum; and
● a charity that looks after our financial endowments, the V&A Foundation, which is registered with the Charity Number 1144508.
Each of the three components acts as a data controller of your personal information, and is registered with the Information Commissioner's Office. If you have a question or concern about personal data at the V&A please contact our Data Protection team at email@example.com.
What personal information do we collect about you?
We collect and process a range of personal information.
Information we collect directly from you
We collect certain information directly from you. This may be via our website (for example information that you provide by filling in forms on our websites, including information provided at the time of requesting our newsletters, buying from our shop or tickets to an exhibition or event), when you enter a competition, when you make a request or query, whether by email, via our websites or on the telephone, or when you register to use our free Wi-Fi service. You may provide some of this information to us when visiting one of our galleries, exhibitions, study rooms, learning facilities, our shop, or to one of our staff, or you may choose to complete comments cards, membership forms or fill out surveys.
This type of information is likely to fall into one of the following categories:
● contact details (for example, name, telephone number, email)
● demographic information (for example, date of birth or nationality)
● information relating to other members of your party and/or participants at any event
● your credit card details or other details that may be required to process a BACS transfer for a donation or a direct debit payment for a membership
● your preferences, interests and previous activities with the V&A, such as events you have attended and donations you have made, as well as purchases from the shop and tickets purchased for our exhibitions and events
● details of your declaration if Gift Aid is applicable to any donation that you make
● your views, opinions, questions and comments
● details of any current memberships, gift memberships you have purchased on behalf of someone, and previous memberships you may have or had with the V&A
● records of your correspondence with us
● your image when you visit as we operate CCTV (and sometimes body cameras) for your security and that of our staff and other visitors; visitors may be photographed at security desks when entering non-public areas
● details of your visits to any of our websites and the resources you access
● data entered on our websites including non-submitted (or abandoned) data
If you purchase a membership for yourself or as a gift, there are more specific details about the information we collect and the way in which we use it in our membership terms.
Information we collect from third parties about you
Some of the above may be provided to us via third-party sources (i.e. from someone who is not part of the V&A). For example:
● you may post reviews or other content relating to the V&A or similar organisations via third-party social media platforms and channels, such as Twitter, Facebook, Tripadvisor or Instagram
● there may be publicly available information about you from trusted sources (such as Who's Who, Debrett's People of Today, Gorkana) that we may use to help us to tailor our communications, and the experiences and events we offer to you
● we are sometimes required to undertake checks on the sources of funds for large donations and other contributions from supporters, and this may include information obtained from third parties such as, for example, Companies House
● we sometimes run events or competitions with other companies and organisations, and they may pass some personal information about participants or entrants to us
Sometimes we may use third parties to assist us in how we try to increase support and identify new supporters – please see 'Who do we share your personal information with?' section below.
Sometimes we may collate information that you have provided to us via multiple direct interactions with us with information from third parties or the technical data referred to below so that we can use this to try to improve the services and information we provide to you.
Technical information automatically collected by us about you
Free Wi-Fi at the V&A
Free Wi-Fi access is available throughout the V&A. If you access the free Wi-Fi, you will be asked to agree to our Wi-Fi terms and conditions of use.
If you connect to the free Wi-Fi using your device the quality of your connection to the Wi-Fi will be monitored as you move around the museum. This device information is solely used to ensure that you are connected to the nearest Wi-Fi access point. We do not require any personal information from you to provide our free Wi-Fi, other than your device's MAC address. We only retain this information for as long as you are using the free Wi-Fi at the V&A. We do not link this MAC address with any personal data that identifies you.
Identifying potential donors, supporters and sponsors and increasing our support
We believe it is in the V&A's legitimate interests in pursuit of our mission to be the world’s leading museum of art, design and performance and to enrich people’s lives by promoting knowledge, understanding and enjoyment of the designed world, to:
● identify and communicate with potential supporters, donors, sponsors and members who might have an interest in the V&A and its mission
● assess the likelihood of increased levels of support from existing supporters
● seek support from potential and existing supporters
We would like to ensure that we understand the people who support us or who are likely to do so. This enables us to engage in more effective communications and offer information about our activities in a more tailored way.
This means that we may undertake research from publicly available sources regarding individuals who are publicly known to be art and/or design enthusiasts and collectors, or who are known to have been involved with similar organisations, or who appear to have interests that align with the V&A's mission or are recognised philanthropists.
We sometimes use third parties to help us with our activities in this regard. This may include asking the third party to analyse personal data we have and make use of other information (including wealth indicators) that is available from accessible records, internet-based resources or that you have made available via social media or traditional media.
We do not intentionally collect children's information (anyone under 13 years old) without explicit consent from the parent or guardian. If you believe a person under 13 years old has provided us with their personal information, or have any concerns regarding this aspect of our policy, please contact firstname.lastname@example.org.
Special category information
Special category personal information is that which, for example, reveals your political or religious beliefs or concerns your health.
This type of information is sometimes necessary to ensure you can enjoy the V&A's offers. For example, we may need information regarding accessibility requirements or dietary requirements so that you are able to access and enjoy our facilities and events. It is part of the V&A's inclusive policy to provide as similar an experience as possible to all visitors and individuals, regardless of any disability.
Similarly, when undertaking due diligence checks in order to accept support and donations, we may have access to special category information or information relating to criminal offences or convictions.
When we make efforts to increase our support and identify new supporters, we may collect some information that falls into this category where it is publicly known.
Our reasons for using your information
The law requires us to ensure we have a lawful basis for processing your personal information. We only use your personal information when we believe it is lawful to do so.
Otherwise we process your personal information usually because it is necessary for one of the following lawful reasons:
● the performance of a contract that you enter in to with us
For example, if you purchase an item from our shop, tickets to an exhibition or event, or a membership, then we must deliver our obligations under the contract we have with you as a result, and your personal information will often be required in order for us to do this.
● our legitimate interests or those of a third party
For example, we believe it is in the V&A's legitimate interests in pursuit of its mission to be the world's leading museum of art, design and performance and to enrich people's lives by promoting knowledge, understanding and enjoyment of the designed world to keep certain people who have attended our events, purchased our products or memberships and/or visited us online informed of ongoing and future events, activities and opportunities at and with the V&A as well as to keep in touch with existing supporters and identify potential supporters.
● compliance with a legal obligation
For example, the law requires us to retain certain information about donations and transactions for tax and audit purposes.
● performing our public tasks
For example, some of our processing is necessary in order to enable us to fulfil our statutory obligations under the National Heritage Act 1983 such as that which is for the purposes of maintaining, extending and promoting our collections.
● for your vital interests
For example, in relation to certain events you may be requested to provide emergency contact details or similar information which we will hold on this basis.
In relation to any marketing or promotional messages from us, you can always opt out of receiving these.
Why do we keep and use your information?
We use your personal information for the purposes listed below.
● providing and delivering our services, goods or information you have requested from us
● administering donations and our relationships with supporters including processing any payment and any Gift Aid claims
● promoting our charitable aims, including fundraising activities
● gathering feedback
● developing and managing the V&A's collections
● managing activities related to any visit or event or exhibition
● fulfilling and responding to requests from you, or made on your behalf
● managing the security and safety of the V&A's facilities, community and collections
● analysing, tailoring, developing or improving our offer
● communications with you including newsletters, marketing and promotional messages or surveys providing information relating to offers, events, opportunities and new services, or new activities of the V&A
● running competitions and dealing with competition entries and results
● operating, managing and promoting our membership scheme
● for our internal operational and management purposes including record keeping, staff recruitment and management
● ensuring content from our websites is presented to you in the most effective manner for you and for your computer
● assessing credit risk, fraud or brand damage risk
● research and audit purposes
Do you have to provide personal information?
If we need to collect personal information by law, or under the terms of a contract we have with you, and you choose not to provide that information when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to deliver an item to you, or to sell you a ticket to an exhibition). In this case, we may be unable to process a transaction and/or may have to cancel something you have requested from us – but we will notify you if this is the case at the time.
Where appropriate, your data may be accessed by and shared with all parts of the V&A.
From time to time, we run competitions or events with other organisations. When we do this, any relevant further details relating to any personal information you submit will be included in the competition or event terms and conditions.
A number of third-party service providers are engaged by the V&A to assist in the provision of our services, our operations and the running and maintenance of our systems. For example, when you make a payment to us this is likely to be processed via secure third-party payment process providers, and many of our systems are maintained and supported by external specialist providers.
When we use third-party service providers, we disclose only the personal information that is necessary to deliver the service. We aim to ensure that we have a contract in place that requires them to keep your information secure and not to use it for their own direct marketing purposes. If you would like a list of the relevant service providers that we use, please contact us at email@example.com.
The American Friends of the V&A and the Canadian Friends of the V&A are independent charities that are committed to supporting the V&A and its work. Please see the section below regarding overseas transfers of personal information.
Sometimes we may ask for your permission to share your details with others. For example, if you attend a training course, we may ask if delegates are happy for us to share their contact details with other delegates.
We may release your information to third parties beyond those listed above only if we are required to do so by law (for example by a court order), or in connection with the prevention of fraud or other crime.
You can ask us to stop sending you newsletters and marketing messages at any time by:
● following the opt out links on any marketing message sent to you
● contacting us at any time at firstname.lastname@example.org
● if you are a member, you can contact us at email@example.com
Where you opt out of receiving these newsletters and/or marketing messages, we will still need to retain and use personal information for other purposes (such as making bookings and other transactions).
How do we protect the personal information you provide to us?
We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third-parties who have a business need to know. They will only process your personal data on our instructions (which, in the case of our employees and contractors, are set out in our policies) and they are subject to a duty of confidentiality.
We regularly review and update our procedures to deal with any suspected personal data breaches. In the event of any suspected personal data breach we will notify the individuals affected and the applicable data regulators, where legally required to do so.
How long will you keep my information?
We aim to keep personal information only for as long as is necessary to fulfil the purposes for which the information was collected.
By law we have to keep certain basic information about our customers and supporters and their transactions with us for specified periods of time. If you would like a copy of our retention policy please email firstname.lastname@example.org.
Will you transfer my information overseas?
Personally identifiable information may be transferred outside of the European Economic Area (EEA) to other third-party service providers incidentally in the course of our activities. Other countries in the EEA have laws that are substantially the same as the UK in order to ensure protection of your personal information.
In limited circumstances, we may share some information with the American Friends of the V&A and the Canadian Friends of the V&A.
We will take steps to ensure that adequate protection is provided for information transferred overseas as required under data protection laws.
What rights do I have in relation to my personal information?
You have a number of legal rights affecting your personal data.
You have the right to:
Request access to your personal data (commonly known as a 'data subject access request'). This enables you to receive a copy of the personal data we hold about you and to check that we are processing it lawfully.
Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.
Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which, if applicable, will be shared with you at the time of your request.
Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party), and there is something about your particular situation that makes you want to object to processing on this ground, as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information that override your rights and freedoms.
Request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in the following scenarios: (a) if you want us to establish the data's accuracy; (b) where our use of the data is unlawful but you do not want us to erase it; (c) where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or (d) you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.
Request the transfer of your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information that you initially provided consent for us to use, or where we used the information to perform a contract with you.
Withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time of your request.
These don't apply in all circumstances, as there are also legal exemptions which may apply, depending on why we have collected the data, and the legal basis on which we are holding the data. We will be happy to explain if you have questions about this.
We may change or update this policy from time to time so please check this page occasionally to ensure that you're happy with any changes.
How can you contact us and/or comment?
Data Protection requests and enquiries
Email address: email@example.com
Postal address: Data Protection Executive, Victoria and Albert Museum, Cromwell Road, South Kensington, London SW7 2RL
Telephone number: (0)20 7942 2000
Please use this address for any data protection requests or enquiries, including requests to exercise your rights (such as the rights of access, rectification, erasure, restriction of processing, and data portability).
Data Protection Officer
The V&A has appointed an independent Data Protection Officer (firstname.lastname@example.org). The DPO is available to advise and assist members of the public, and members of V&A staff, in the exercise of their rights, for example by escalating an existing data protection request. The DPO of the V&A is Trilateral Research. You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK Data Protection Authority.
We would appreciate the chance to deal with your concerns before you approach the ICO so please contact us first.