Privacy Policy

Effective 15 May 2018

At the ICA, we are committed to upholding your privacy and safeguarding the personal data you share with us.

Under the Data Protection Law in the United Kingdom [(including, but not limited to the EU General Data Protection Legislation and UK data protection laws and regulations ) 'Data Protection Law'], we are required to provide certain details regarding the ICA’s collection, use and protection of your personal data. Further information is outlined below.

We may modify or update this Privacy Policy in order to reflect changes to our privacy practices, or for other operational, legal or regulatory reasons. If we make changes to this Privacy Policy, we will notify you of such changes by posting the revised policy on this website, or by other means of communication where appropriate.

If you have any queries about this website and how the ICA uses your personal data after reading this Privacy Policy, please contact:

Your Data Rights

Data Protection Law gives you certain legal rights in relation to how the ICA records and uses your personal data.

If at any point you believe the personal data we hold on you is incorrect, you can request to see this information and have it corrected or deleted (where necessary) by contacting the relevant Head of Department in the ICA. You can find contact details for each ICA Department here.

A summary of your rights under Data Protection Law is as follows:

1. The right to access the personal data we hold on you and other information about how we use it, who we share it with, where we obtain it and how long we keep it for. We will usually have one month to respond, except for complex requests where this may be extended by a further two months and we may charge a fee for dealing with any manifestly unreasonable or excessive requests.

2. The right to request that we correct and update any inaccurate or out of date personal data we hold on you.

3. The right to data portability where your personal data was collected with your consent or under contract and our processing of that personal data is automated.

4. The right to withdraw your consent to the processing of your personal data at any time, where such processing is subject to your consent.

5. The right to object to the processing of your personal data or to request that we erase your personal data, where we no longer have a legitimate reason for processing such data or it is being processed unlawfully.

6. The right to lodge a complaint with the UK data protection regulator or the Information Commissioners Office (ICO) if you think that we are breaching your rights under Data Protection Law.

If you wish to exercise any of your rights above or raise a complaint around how we have handled your personal data, you can contact info@ica.art and request for our Deputy Director to investigate the matter.

We may ask for more information from you to verify your identity or clarify the nature of your request before we can respond in full. If you make a subject access request, we may ask you to fill in a form to help us process your request more efficiently.

If you are not satisfied with our response and you believe we are not processing your personal data in accordance with the law, you can contact the Information Commissioner’s Office (ICO) by telephoning +44 (0)303 123 1113, sending post to the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, or visiting their website at: https://ico.org.uk/concerns/

Our Data Collection

We need to collect, hold and use personal data in order to provide goods, services and marketing information as well as other purposes in connection with the operation and administration of the ICA, including:

Membership administration (managing the ICA Membership programme)
Managing the purchasing of tickets, artworks and merchandise
Sharing details of our programme with you when you sign up to our newsletters or if you are a press contact
Sharing updates from our Events Team with those who have been in contact regarding private hires
Making a donation to the ICA or signing up as an ICA Friend
Agreeing to be part of a committee, join our Board or present a talk or event at the ICA
Applying for a vacancy at the ICA
Providing services as a contractor or third party employee
Booking one of our free programmes or facilitating active participation in our programme in some way that necessitates holding a list of participants
Other purposes we inform you about and that you occasionally agree to

We will not collect or store any personal data that we do not need or is not required for legal or other legitimate purposes. Marketing emails and other electronic communications will only be sent to individuals at their email address where we have their consent or the information relates to products/services they previously purchased from the ICA. All electronic marketing communication from us will have an unsubscribe option, so you can let us know immediately if you do not want to hear from us.

Use of Data

All the personal data we hold about you will be processed by our staff or authorised contractors only in connection with the above. Your personal data may be stored or processed via third party suppliers who only process personal data acting in accordance with our instructions. These suppliers help us with: emailing newsletters and invitations services to facilitate online purchases (Mailchimp), ticketing payments and membership (Patronbase, Shopify, Rapidata and Worldpay) or running surveys that you may choose to participate in (Survey Monkey and Audience Finder). You can click on each of these links to find more information about the privacy policies of each of these third parties.

We take all reasonable steps to ensure that your personal data is processed and stored securely in accordance with the Data Protection Law. We also have internal guidelines in place to make sure that ICA staff respect your privacy and only use your personal data for lawful, legitimate purposes.

What we collect and how long we keep it

The ICA collects personal data in relation to the following areas:

Membership

When you sign up for an ICA Membership, we collect your personal data to process membership subscriptions and keep in touch with you about your membership. This information is stored and processed on our membership and third party ticketing software systems (Patronbase, Mailchimp and Rapidata) and digital ICA files, accessible only to our Membership Team. We keep this information for the duration of your membership and six years after your membership has lapsed to deal with any contract queries or legal claims. Following that, we anonymise your personal data retaining only details of your purchase history.

We will also ask for your consent to send you emails regarding Membership news and offers. You can unsubscribe from these emails at any time using the unsubscribe link at the bottom of each email.

Online Purchases

When you make an online purchase, we collect your personal data in order to process your purchase, deliver the purchased item to you and provide any required after-sales services.

Your online purchases for tickets and membership are processed through a third party payment processor, Worldpay, and the personal data you submit is stored on our membership and ticketing software Patronbase. This information is only accessible to our Box Office and Membership Teams. We keep this information to allow for quicker future bookings and to notify bookers about vital information or changes to the programme. Personal data is retained for a maximum of six years since your last booking or purchase.

Your online purchases from the ICA Bookstore are processed through our third party e-commerce platform, Shopify. If you are making an online purchase via Shopify, you can also sign up as a guest instead of setting up an account – this means that your personal data will not be retained by Shopify and the ICA after your purchase has been made and delivered.

You can also make in-person purchases from the ICA for tickets, membership, books and other merchandise.

Online ICA Editions purchases are currently processed through Worldpay, but we are in the process of migrating our purchase system to Shopify. Shopify is currently used for our ICA Editions purchases at art fairs.

You can find details on our Ticketing Terms and Conditions here.

In-person Purchases

Our in-person ticket and membership purchases are processed through Patronbase. We only take personal data from customers buying tickets if the performance or event is not made on the day of the booking. This allows us to update you about any changes to timings or venue.

Personal data is retained for a maximum of six years since your last booking or purchase, to deal with contract queries or legal claims and is only accessible by our Box Office and Membership Team.

When you make an in-person purchase from the Bookstore, your personal data is not stored unless you order an item which is not in stock. In this case, we will request your contact information, which is then stored in a secure location that is only accessible to Bookstore Team. Your personal data is deleted once the item has arrived, is purchased and dispatched to you.

With regards to in-person ICA Editions sales, we collect your personal data through a purchase form for the purpose of payment, raise an invoice and ship the ICA Edition to you. All of your personal and financial data is only accessed by the staff responsible for ICA Editions and by our Finance Team. This form is only stored until Edition has been paid for and shipped. We also need to store your personal details for provenance purposes, as is routine with artwork purchases. In some cases, the artist of the edition might request your personal data for their provenance records. When this happens, we will get in touch with you to request your consent before we share your personal data with the artist.

The ICA does not store any credit or debit card details.

Newsletters and Invitations

You can sign up to receive our newsletters through our general newsletter sign-up or at the point of an online purchase. All electronic marketing communication from us will have an unsubscribe option so you can let us know immediately if you do not want to hear from us.

The general newsletter sign-up is via a Wufoo form integrated with Mailchimp, so your data automatically uploads to our mailing lists. For newsletters and invitations, your personal data is only accessible by the Communications Team.

If you sign up to our newsletters at the time of online or in-person purchases, your personal data is collected via Patronbase before it is uploaded to Mailchimp.

All our newsletters and invitations, with the exception of our Membership newsletters, are sent out by our Communications Team.

Press

Members of the press, who we have been in touch with previously, may receive information from the ICA on forthcoming programme and invitations to events as sent out by the Communications Team. You can unsubscribe from these emails at any time using the unsubscribe link at the bottom of each email. You can sign up to receive emails from us via our general newsletter sign-up or by emailing press@ica.art

Surveys

We might occasionally post the link to a survey form on our website or on our social media. These surveys might be needed as part of the requirements set out by our funders or to help us better understand our reach and visitors. These surveys will be anonymous and the personal data we request will be limited to the basic information we need for the survey. Only the Communications Team have access to this data.

Surveys related to equal opportunities are accessed and processed by the ICA’s HR Team – see below.

Private Events and Venue Hire

If you hire one of the ICA’s private hires spaces, we collect your personal data in order to process and deliver your booking. After your event, to comply with tax and accounting requirements we store all financial records for up to seven years and other contract paperwork for up to six years to deal with contract queries or legal claims.

If you write to us to enquire about our hires spaces, we will request for your consent to add you to our database to send you information related to our hires offers and new developments. You can unsubscribe from these emails at any time using the unsubscribe link at the bottom of each email.

Donations and ICA Friends

When you make a donation to the ICA or sign-up as an ICA Friend, we collect your personal data to process your donation, deliver Friends services to you, email you about the Friends Programme and related events and for gift aid purposes. If at any point you no longer wish to receive emails from us, you can use the unsubscribe link at the bottom of each email.

Your personal data will be requested via a Friends form. In order to process a donation, you may wish to provide your credit or debit card details via the Friends form. Once your donation is processed, your financial data is no longer stored but your contact details will be stored on Patronbase. The Development, Finance and Senior Management Teams have access to this data, which is stored for as long as your patronage lasts and deleted six years after your patronage has lapsed to deal with contract queries or legal claims.

If we deal with a Trust or a Foundation, the personal data that we hold will be the contact details from the relationship manager or primary contact of the organisation. This data is only accessed by the Development Team.

Other Contributions to the ICA

When you agree to be part of a committee, join our Board, present an exhibition, talk or event for the ICA or work with us on a project, we will need to collect, store and use your personal data in order for us to work together. This data is held securely and only accessed by the staff member or department who is working with you. All contract paperwork and personal data that you provide us with is stored for the duration of our contract/work together and for six years afterwards to deal with contract queries or legal claims.

We will ask for your consent to send you marketing materials by email. You can unsubscribe from these emails at any time using the unsubscribe link at the bottom of each email.

If you ask us to forward marketing materials to your contacts on your behalf, we will require you to confirm that you have the consent of your contacts to receive these materials.

Job Applications

Recruitment for ICA vacancies is by application form only to the jobs@ica.art email account. All our current vacancies are advertised here.

Your application will be stored for the duration of the recruitment process (typically six to eight weeks after the deadline). If you have been invited for an interview, your application will be stored for six months after your interview date so we can respond to any queries you may have about your application and interview. If you are offered and accept a role at the ICA, your application form will be stored for the duration of your employment at the ICA.

All applications to the account will be accessed by the HR Team. For shortlisting and interview purposes, your application will be reviewed by the HR Team and the Manager recruiting the role.

As part of your application, we also request you to fill in an anonymous Equal Opportunities form via Survey Monkey. This form is voluntary and anonymous, and is used to help monitor our recruitment and diversity reach. Surveys are stored for a period of twelve months before being deleted.

Personal data of suppliers, contractors and their employees

We may need to collect personal data from suppliers, freelance contractors or their employees to allow for the delivery of a service to the ICA. This data will only be accessed by the department or the staff member working with you. Contract paperwork will be stored for the duration of the contract and for six years after the contract has lapsed to deal with contract queries or legal claims. Personal data stored outside the framework of the contract or any related paperwork will be deleted after our work together comes to an end.

Cookies

A 'cookie' is a tiny element of data that a website can send to a visitor’s computer’s browser (e.g. MS Internet Explorer or Google Chrome), so that their computer (or electronic device used to access the website) will be recognised by the ICA website on their return. Cookies also allow our web server to recognise a computer on connection to the ICA website, which in turn allows our server to make downloading of website pages faster than on first viewing. In addition, cookies may also be used by us to establish statistics about the use of the ICA website by Internet users by gathering and analysing data such as most visited pages, time spent by users on each page and website performance etc.

We collect and use such cookie data to enable us to develop and enhance the experience of visitors to the ICA website. Cookies do not identify you personally, but the computer or device used to access our website.

The data collected by our servers and/or through cookies that may be placed on your computer or device will not be kept for longer than is necessary to fulfil the purposes mentioned in this Policy. Unless stated in this Policy, cookies on the ICA website are usually only active for the duration of your visit and are not stored on your computer once you have closed your web browser.

Navigation data about site viewers is automatically collected by our servers. If you do not wish to have this navigation data collected, we recommend that you do not use the ICA website.

You can set your browser to block the recording of cookies on your computer or device to minimise the amount of data that may be collected about your visit. Your browser can also be set to notify you when a cookie is being recorded. However, if you block cookies then you may not be able to use all the features or services on our website.

We may at some stage use cookies to identify users when they visit the website for personalised services. For example, if you are an ICA Member, you can log in to our ticketing partner Patronbase using your email address and a password to access ticket discounts. In this case, it is necessary for us to use a cookie to identify you for as long as you are using the website and logged on.

In such circumstances, these cookies may be kept on the hard drive of your computer following closure of your web browser. Cookies used in connection with such personalised services enable us to build up a profile of our users and to develop personalised versions of the website.

We may also automatically collect information about each page you visit, including your domain, IP address, the previous site accessed and the browser you use and your operating system. This information is used for the purpose of monitoring and improving use of our website and is not used to identify you in any way.

Information generated by the use of cookies may be compiled by the ICA, but this will only be in an aggregate form so that no individual can be identified personally.

Google Analytics

The ICA website also uses Google Analytics, a web analytics service provided by Google, Inc., which uses cookies to help us analyse how the ICA website is used. The information generated by the cookie about your use of the website (including your IP address at the time of logging on), will be transmitted to and stored by Google on servers in the United States.

Google will use this information for the purpose of evaluating your use of the website, compiling reports on website activity for website operators and providing other services relating to website activity and Internet usage.

Google may also transfer this information to third parties where required to do so by law, or where such third parties process the information on Google's behalf. Google will not associate your IP address with any other data held by Google. For more information, see 'How Google uses data when you use our partners' sites or apps'.

You may refuse the use of these cookies by selecting the appropriate settings on your browser.

The ICA uses this data to understand who our users are as an anonymised mass and how they are using our site. We do not have the ability to identify our website users by their IP address.

Social Media

All the social media platforms we use provide anonymised data on the users of our pages or accounts for the purposes of analysis and reporting. We do not store identifying user data from any of the users of our social media platforms. We abide by the Terms and Conditions of each individual social media platform.

Filming, photography and CCTV

Sometimes filming, photography and audio recording is in use at the ICA, particularly during events and the recordings may be posted on our website or released by the ICA for promotional purposes. When this is the case, it is made clear by signage advising visitors to speak to ICA staff for further information if needed.

CCTV is in use at the ICA to protect our property and visitors. If you would like to see our CCTV policy, please email: info@ica.art

The lawful grounds on which we collect and process personal data:

The ICA processes your personal data for the above purposes relying on one or more of the following lawful grounds under Data Protection Law:

Contract: where we provide services, in order to set up and perform our contractual obligations to individuals
Consent: where you have freely provided your specific, informed and unambiguous consent for us to process your personal data for particular purposes
Legitimate Interests: in connection with the ICA's legitimate interests of being able to effectively administer and promote the work of the ICA, run events, operate our Membership and Friends' programmes, run our shops and manage our services in a safe an efficient manner. We will always seek to pursue these legitimate interests in a way that does not unduly infringe on your other legal rights and, in particular, your right to privacy; and/or
Legal Obligations: where we need to process personal data to comply with a legal obligation or for the purpose of us being able to establish, exercise or defend legal claims

Data Sharing

We do not share, sell or rent your personal data to third parties for marketing purposes. However, we may need to share your personal data with third parties in the following circumstances:

When using suppliers or service providers to support our operations as described in this Privacy Policy. We require these third parties to act lawfully in accordance with our instructions and ensure that appropriate controls are in place to keep your information secure.
Where we are under a duty to disclose your personal information in order to comply with a legal obligation (for example to law enforcement agencies), or in order to enforce or apply our rights (including enforcing applicable terms and conditions) for where needed to protect ourselves against criminal or illegal activity – for example, to conduct fraud checks.

Data transfers outside Europe

For financial and technical reasons, the ICA may, on occasion use the data hosting or data processing services of a supplier who is based outside the UK and European Economic Area (EEA), which means that your personal information may be transferred to that supplier and processed and stored outside the UK and EEA.

This includes countries, such as the United States, that are not currently considered to have the same standards for legal protection of personal data that you enjoy in the UK.

However, we will always take steps to choose highly reputable suppliers, who respect your security and the ICA will put suitable legal safeguards in place with that supplier to protect your personal data, so that it is subject to the same standards of privacy that you have in the UK.

For further information about the above, please email: info@ica.art