Arnolfini needs to gather and use certain information about individuals. These can include customers, suppliers, business contacts, employees and other people the organisation has a relationship with or may need to contact. The information gathered helps us build relationships with you. This privacy policy describes how your personal data is collected, handled and stored to meet our data protection standards – and to comply with the law. You will also find included how our website uses cookies to ease your browsing experience.
This policy describes how your personal data is collected, handled and stored to meet our data protection standards – and to comply with the law.
This privacy policy ensures Arnolfini:
- Complies with data protection law and follows good practice
- Protects the rights of customers, staff and partners
- Is transparent about how it stores and processes individuals’ data
- Protects itself from the risks of a data breach
Data protection law:
The General Data Protection Regulation (GDPR) applies in the UK and across the EU from May 2018. It requires personal data shall be:
- Processed lawfully, fairly and in a transparent manner in relation to individuals;
- Collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research or statistical purposes shall not be considered to be incompatible with the initial purposes;
- Adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed;
- Accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay;
- Kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes subject to implementation of the appropriate technical and organisational measures required by GDPR in order to safeguard the rights and freedoms of individuals;
- Processed in a manner that ensures appropriate security of personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.
The controller shall be responsible for, and be able to demonstrate, compliance with the principles.
What information do we collect?
Arnolfini processes the following strands of information:
- names of individuals
- postal addresses of individuals
- age or date of birth of individuals
- email addresses
- telephone numbers
- online identifiers
- payment card details (please note, we will not hold payment information for any longer than it takes to process a transaction. All debit and credit card information is processed securely, and in accordance with the Payment Card Industry Data Security Standard or PCI-DSS)
- Gift Aid status and donation history (only collected on donation)
This data is collected through an opt-in process either;
- online by signing up to our e-newsletter
- online by booking a ticket to an event
- online by completing a feedback form in regards to an event attended
- via email when one of our team members is contacted
- in person by completing a customer feedback form
- in person by completing an evaluation form for an event attended
- by signing up to Arnolfini’s Membership scheme
- by donating online
- by sponsoring one of our programmes
- by completing a Gift Aid form
- by completing an Application Form for a paid or voluntary position
- by completing an employee Starter Form
- by sending us a proposal
- by hiring one of our space
- Equalities Monitoring Form
Arnolfini is the data controller for all data we collect and store. We collect personal information through a number of different ways all of which are subject to strict data security processes to ensure personal information is kept safe at all times. We use the following processors to enable us to collect and use your data;
- Mailchimp for email communications
- Eventbrite and Headfirst for ticket bookings
- JustGiving for online donations
- Sage50 for accounting information
- Audience Agency and Culture Counts for visitor surveys
- Password protected server based storage for HR files and Member’s information
End of year filing takes place between April and June each year whereby records are audited internally and disposed of when necessary in accordance with our document retention policy.
Arnolfini use information in a number of ways, the main ways being:
- because it is necessary to administer the services requested from us and to fulfill our obligations to in providing these services; or
- to inform by email or other means of similar events or services run by us which we think may be of interest; or
- in the case of our profiling (see below) in order to pursue Arnolfini’s legitimate interests in raising funds. Where we process personal data on this basis, we will only do so where it does not prejudice privacy rights.
They improve things by:
- remembering settings, so you don’t have to keep re-entering them whenever you visit a new page
- remembering information you’ve given (eg your postcode) so you don’t need to keep entering it
- measuring how you use the website so we can make sure it meets your needs
Our cookies aren’t used to identify you personally. They’re just here to make the site work better for you. Indeed, you can manage and/or delete these small files as you wish.
To learn more about cookies and how to manage them, visit AboutCookies.org. Or please read on to find out more about how and where we use cookies.
How do we use this information?
Outlined below are the various types of processing that Arnolfini carries out. Specifically we process information in the following ways:
To carry out one of our services or contracts with you:
- To fulfil ticketing and/or donation requests (including sending a confirmation of booking or donation by email and/or letter)
- Process payments (please note we do not store any Credit Card or other payment information once the transaction has been completed)
- Provide the best possible customer service and to help us with our internal administration
- To make contact with important information relating to bookings or donations, such as order confirmation or event details and reminders
Where we have consent from you we will:
- Send updates via email about what’s on, news or about supporting us
- To keep people informed of how their donation is contributing to Arnolfini, to invite them to special events and inform them of details of how they can continue to support Arnolfini
- Share details with other arts organisations whose work may have been seen at, or in partnership with Arnolfini. This will be limited to name, email address and booking details for events linked with the partner organisation. People will always be able to opt out of their communications by contacting them directly
Where we have justifiable reason (including legal obligation and legitimate interest):
- Analyse booking history in order to learn about interests and preferences to help us target our marketing communications so that they’re more relevant
- Send occasional mail informing people of important news and how they can support Arnolfini
- For classifying our audience into groups or segments, using booking and publicly available information. These segments help us to understand our audience better and ensure we’re sending relevant messages to each group
- Measure and understand how our audiences respond to a variety of marketing activity so we can ensure our activity is well targeted, relevant and effective
- To make contact to ask for participation in audience research. Whereby audiences are under no obligation to participate in research and, should they provide any further information, Arnolfini will inform them how any further information will be used. All information gathered for research purposes is anonymised and aggregated for analysis
- Analyse and continually improve the services we offer including our programme, our website and our ticketing service
- To keep our database accurate and relevant
- The use of CCTV recording equipment in and around our premises for monitoring and security purposes
- Undertake due diligence to detect and reduce fraud and credit risk
- To analyse the way in which our website is used and the content and links that you interact with, in order to improve our website services
- To analyse the way in which our emails to you are received by you, and the content and links that you interact with, in order to improve our communications with you
- To help diagnose and manage the website, to audit the geographical make-up of users, and to establish how you have arrived at the website (this is through a public IP address which is a unique number which allows a computer, group of computers or other internet connected device to browse the internet. The log file records the time and date of a visit, the pages that were requested, the referring website (if provided) and the internet browser version)
Before contacting a small number of individuals we may seek additional information from Arnolfini’s booking sites, business network information and publicly available information relating to: residential location, wealth and assets, family*, career, donations to other organisations (including political parties where they are made public by the individual) and hobbies and interests. This helps us understand the background of the people who may choose to support us and helps us to make requests for gifts to those who may be able and willing to give. We may also use publicly sourced images to help identify individuals who attend our special events.
* This does not include information about children unless given personally by the individual concerned.
We use a number of different sources to help our fundraising activities, including the use of company, director and shareholder information from publicly available information providers.
Who do we share it with?
Arnolfini will never sell your data. However, we do share data with your consent to partner organisations to enable the development of projects or wider sector development. This data is usually collected through feedback given on our exhibition programme, events or activities.
The below list shows Third Party organisations that Arnolfini shares personal information with. Data Sharing Agreements are countersigned and agreed by both organisations to ensure lawful sharing of information. This agreement specifies exactly what either party is allowed to do with the data and how they keep it safe.
We share data with;
- UWE
- Plus Tate Partners
- Audience Agency
- Public funding bodies such as Arts Council England or Bristol City Council
- Julie’s Bicycle
- Culture Counts
- Project and programme partners
Keeping it safe
Arnolfini is committed to ensuring personal information is secure at all times. We store and process personal data securely using suitable physical, electronic and operational procedures to safeguard and secure all personal information. We will ensure that any third parties we use for processing your personal data do the same. We limit access to personal data to only those staff members who require it to carry out their role, and ensure all staff understand the Data Management and Privacy Policies.
We keep personal information:
- For as long as we need to for the purposes for which it was collected or,
- (if longer) for any period for which we are required to keep personal information to comply with our legal and regulatory requirements or,
- until we are asked to delete personal data
We will not keep more information than we need. The retention period will vary according to the purpose, for example if purchasing a ticket only, we will typically keep data for up to six years from the date of the last transaction whereas data for a pledged a legacy to Arnolfini, we be held until notified by an executors.
We assess the personal data that we hold annually to determine its relevance and destroy personal data if we no longer require it or no longer provide any services to you.
Cookies
Data is automatically processed through cookies on our website. A cookie is a small data file we place on your computer, as most websites do, to make using the site quicker.
They improve things by:
- remembering settings, so you don’t have to keep re-entering them whenever you visit a new page
- remembering information you’ve given (e.g. your postcode) so you don’t need to keep entering it
- measuring how you use the website so we can make sure it meets your needs
Our cookies aren’t used to identify anyone personally. They’re just there to make the site work better. They can be managed and/or deleted if the users wishes to do so and will be prompted as such on entering the website.
To learn more about cookies and how to manage them, visit AboutCookies.org.
How we use cookies
arnolfini.org.uk uses cookies in several places – we’ve listed each of them below with more details about why we use them and how long they will last.
In most cases, we will let you know before we store a cookie on your computer by providing a message similar to this: sets a cookie.
Measuring website usage (Google Analytics)
We use Google Analytics to collect information about how people use this site. We do this to make sure it’s meeting its users’ needs and to understand how we could do it better.
Google Analytics stores information about what pages you visit, how long you are on the site, how you got here and what you click on. We do not collect or store your personal information (e.g. your name or address) so this information cannot be used to identify who you are. We do not allow Google to use or share our analytics data.
The following cookies are set by Google Analytics:
| Name | Purpose | Expires |
|---|---|---|
| _utma | This randomly generated number works with _utmc to calculate the average length of time users spend on our site | 2 years |
| _utmb | This randomly generated number works with _utmc to calculate the average length of time users spend on our site | 30 minutes |
| _utmc | This randomly generated number works with _utmb to calculate when you close your browser | when you close your browser |
| _utmz | This is a randomly generated number and information about how the site was reached (e.g. direct or via a link, organic search or paid search) | 6 months |
| GDS_successEvents GDS_analyticsTokens | These cookies help us identify how people use GOV.UK so we can make the site better | 4 months |
You can opt out of Google Analytics cookies by visiting this page on Google.
Cookies from YouTube
On some parts of this site, we use YouTube to provide useful videos. YouTube sets some or all of these cookies when you visit one of these pages.
| Name | Purpose | Expires |
|---|---|---|
| _use_hitbox | This is a randomly generated number that identifies your browser | when you close your browser |
| VISITOR_INFO1_LIVE | Set when viewing a page with Youtube videos on it. It is set by Youtube so they can count the views of embedded Youtube videos on them. | 9 months |
Cookies from Vimeo
We embed videos from Vimeo. This mode may set cookies on your computer once you click on the Vimeo video player.
To find out more visit Vimeo’s privacy policy
Cookies from AddThis
To find out more visit the AddThis privacy policy
Cookies from SoundCloud
To find out more visit the SoundCloud privacy policy
Your rights
All individuals who are the subject of data held by Arnolfini are entitled to:
- Ask what information we hold about them and why
- Ask how to gain access to it
- Make changes to it if they believe it to be inaccurate or incorrect
- Be informed about how to keep it up to date
- Be informed how the company is meeting its data protection obligations
- Restrict, or object to, our processing of their personal data
- Ask at any time Arnolfini amends or stops using personal information including for marketing purposes
This can be done by contacting us via our Contact page. We will then respond directly to you as soon as possible and take next steps to verify your identity and process of removal. Evidence of removal of data can be provided by Arnolfini on request.
All individuals have the right to be forgotten and on request we will stop contacting you. All e-newsletters related to marketing, programme or fundraising contain an ‘unsubscribe’ option within the email body.
In order to withdraw consent individuals can contact us via our Contact page.
An individual has the right to lodge a complaint with the supervisory authority, The Information Commissioner’s Office – www.ico.org.uk
Ongoing measures to ensure compliance
Meeting the obligations of the GDPR to ensure compliance will be an ongoing process. Below are the ongoing measures implemented to:
- Maintain documentation/evidence of the privacy measures implemented and records of compliance
- Regularly test the privacy measures implemented and maintain records of the testing and outcomes.
- Use the results of testing, other audits, or metrics to demonstrate both existing and continuous compliance improvement efforts.
- Keep records showing training of employees on privacy and data protection matters.
We will continue to review our policy in line with changes to regulation and best practice to ensure you information is kept safely and lawfully.
