1. Who we are
Art Explora UK (“we”, “us”, “our”) is a registered charity in England and Wales (charity number 1202489), based at Somerset House, Strand, London WC2R 1LA. We exist to expand access to arts and culture, including through our touring Mobile Museum programme.
Where we work with our trading subsidiary, Art Explora UK Ltd, in connection with any of the activities described in this policy, that subsidiary processes personal data on the same basis and subject to the same commitments set out here.
We are registered with the Information Commissioner's Office (ICO) as a data controller under registration number ZC242114.
2. About this policy
This policy explains how Art Explora UK collects, uses, shares and protects personal data, and what rights you have over your information. It applies to supporters, donors, newsletter subscribers, event and Mobile Museum visitors, volunteers, job applicants, corporate partners and other individuals who contact us or use our website.
We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, together with the Privacy and Electronic Communications Regulations 2003 (PECR) as amended, which govern electronic marketing and cookies. As a registered charity we also have regard to the Charities Act 2011 and the Fundraising Regulator's Code of Fundraising Practice in relation to donor data. UK data protection law was amended by the Data (Use and Access) Act 2025, and we will update this policy as further guidance on that Act is issued.
3. Information we collect
The personal data we collect depends on how you interact with us, and may include:
- Identity and contact data: name, postal address, email address, telephone number.
- Newsletter and mailing list data: name and email address, and your communication preferences.
- Donation and Gift Aid data: payment details (processed by our payment provider — we do not store full card details), donation history, and Gift Aid declarations, including confirmation that you are a UK taxpayer.
- Event and Mobile Museum data: booking details, dietary or access requirements you tell us about, survey and feedback responses, and photographs or footage taken at events (where signage or booking terms make this clear).
- Volunteering and recruitment data: CVs, application details, references and right-to-work information for volunteers, job applicants and staff.
- Corporate partner and funder contacts: names, job titles and contact details of individuals at partner, funder and supplier organisations (for example our insurance brokers and insurers), used to manage those relationships.
- Website and technical data: IP address, browser type, device information and usage data, collected via cookies and similar technologies — see §6.
We collect special category data (such as health, dietary or accessibility information) only where you choose to share it with us, for example to arrange access support at an event, and only use it for that purpose.
4. How we use your information, and our legal basis
Under UK GDPR we must have a valid legal basis for each way we use personal data. The table below sets out our main purposes and the basis we rely on for each.
Where we rely on legitimate interests, we have considered that our use of your data is proportionate, expected, and does not unfairly impact your rights — you can ask us for more detail, or object, at any time (see §10).
- Purpose: Sending our newsletter and updates on our work.
- What we collect:
- Legal basis (UK GDPR, Art. 6): Consent, or the "soft opt-in" for existing supporters (Regulation 22, PECR)
- Purpose: Processing donations and claiming Gift Aid
- What we collect:
- Contact details
- Payment data
- Taxpayer status
- Legal basis (UK GDPR, Art. 6): Performance of a contract; legal obligation (HMRC Gift Aid rules)
- Purpose: Administering event and Mobile Museum bookings
- What we collect:
- Contact details
- Booking and access requirements
- Legal basis (UK GDPR, Art. 6): Performance of a contract; legitimate interests (running our programme safely and effectively)
- Purpose: Understanding and improving our programme
- What we collect:
- Feedback
- Survey responses
- Attendance data
- Legal basis (UK GDPR, Art. 6): Legitimate interests (evaluating and improving our charitable activities)
- Purpose: Recruiting staff and volunteers
- What we collect:
- Application and reference data
- Legal basis (UK GDPR, Art. 6): Legitimate interests; steps to enter a contract; legal obligation (right-to-work checks)
- Purpose: Managing relationships with partners, funders and suppliers
- What we collect:
- Legal basis (UK GDPR, Art. 6): Legitimate interests (managing our partnerships); legal obligation (reporting to funders such as DCMS)
- Purpose: Website analytics and functionality
- What we collect:
- Technical and usage data via cookies
- Legal basis (UK GDPR, Art. 6): Consent (non-essential cookies); legitimate interests (essential/strictly necessary cookies)
- Purpose: Meeting our legal and regulatory obligations
- What we collect:
- Relevant records as required
- Legal basis (UK GDPR, Art. 6): Legal obligation; vital interests, where safety is at risk
5. Marketing communications
We will only send you marketing communicationsby email where you have given consent, or where you are an existing supporterand the “soft opt-in” under PECR applies (for example, because you havepreviously donated or booked an event with us and did not opt out at the time).You can withdraw consent or unsubscribe at any time using the link in any emailwe send, or by contacting us using the details in §14. We do not use your datafor automated decision-making that produces legal or similarly significant effectson you.
6. Who we share your information with
We do not sell your personal data. We share it only where necessary, with:
- Service providers acting on our instructions (processors), such as our email/newsletter platform, payment and donation processor, and any CRM or ticketing system we use Webflow, Beacon and Mailchimp. These providers are contractually required to protect your data and only use it as we instruct.
- Insurance brokers and insurers (currently Gallagher and Hiscox), where necessary to insure our Mobile Museum tours and collections — this is generally limited to information about the exhibition, vehicle and itinerary rather than supporter data.
- Funders and regulators, such as the Department for Culture, Media and Sport (DCMS), the Charity Commission, and HMRC, where we are required to report on funded activity or comply with the law.
- Professional advisers, such as auditors, lawyers and insurers, where necessary for their services to us.
- Law enforcement or other authorities, where we are required to by law or to protect the vital interests of an individual.
- Data sharing with Art Explora France (and vice-versa) only happens if compliant with UK or EU GDPR.
7. International transfers
Some of the organisations we work with are based outside the UK. Where we share personal data with organisations in the European Economic Area (EEA), including France, we do so on the basis that the UK Government currently recognises the EEA as providing an adequate level of data protection, so no additional safeguards are required beyond this policy. Where we share personal data with organisations outside the UK and EEA (for example, some website analytics or cloud service providers based in the United States), we put in place appropriate safeguards required by UK GDPR, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. You can ask us for more information about these safeguards using the contact details in §14.
8. How long we keep your information
We only keep personal data for as long as necessary for the purposes it was collected, or as required by law. As a guide:
- Category of data: Newsletter and marketing contacts
- Retention period: Until you unsubscribe or ask us to stop, or after a period of inactivity
- Category of data: Donation and Gift Aid records
- Retention period: 6 years from the end of the relevant tax year, in line with HMRC record-keeping requirements
- Category of data: Event and Mobile Museum booking/feedback data
- Retention period: Up to 2 years after the relevant tour or event, unless needed for funder reporting
- Category of data: Volunteer and job applicant data (unsuccessful applications)
- Retention period: Up to 2 years after the recruitment process ends, unless you agree we can keep it longer
- Category of data: Corporate partner and funder contact data
- Retention period: For the duration of the relationship and a reasonable period afterwards
- Category of data: Website and cookie data
- Retention period: As set out in our cookie settings, typically no longer than 26 months
These are guide periods; exact retention isset out in our internal retention schedule and may vary where we have a legalor funding obligation to keep records for longer.
9. Keeping your information secure
We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse or disclosure, and we require any third party who processes data on our behalf to do the same. No method of storage or transmission is completely secure, but we review our practices regularly to keep them appropriate to the risk.
10. Your rights
Under UK GDPR, you have the right to:
- Access the personal data we hold about you.
- Have inaccurate data corrected.
- Ask us to delete your data, in certain circumstances.
- Restrict or object to our processing of your data, including for direct marketing.
- Receive your data in a portable format, where we process it based on consent or contract.
- Withdraw consent at any time, where we rely on consent.
- Complain to the Information Commissioner's Office (ICO) if you are unhappy with how we have handled your data.
To exercise any of these rights, contact us using the details in §14. We will normally respond within one month. You can contact the ICO at Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, telephone 0303 123 1113, or via ico.org.uk.
11. Children and schools
Our Mobile Museum programme and other activities sometimes engage schools and young people. Where we work with children, we collect only the minimum information necessary (usually via the school or a parent/guardian, rather than directly from a child), and we do not knowingly collect personal data directly from children under 13 without appropriate parental or guardian consent.
12. Changes to this policy
We may update this policy from time to time, for example to reflect changes in the law or in how we work. We will post any changes on this page and update the “last updated” date at the top.
13. Contact us
If you have any questions about this policy or how we handle your personal data, please contact:
Marketing and Communications Manager
Art Explora UK, Somerset House, Strand, London WC2R 1LA
Email: infouk@artexplora.org
If you are not satisfied with our response, you have the right to complain to the ICO (see §11).
