This website is brought to you by Northern Gallery for Contemporary Art.
Northern Gallery for Contemporary Art (NGCA) is owned by University of Sunderland (the University) (we, our or us), and the public programme is delivered by Sunderland Culture. Sunderland Culture and the University are committed to protecting and respecting your privacy.
Sunderland Culture is a new organisation created to bring together the cultural programmes of Sunderland City Council, University of Sunderland and Music, Arts and Culture (MAC) Trust into a single, independent, resilient delivery model and realise the ambition of a city brimming with creative potential.
Sunderland Culture operates National Glass Centre and Northern Gallery for Contemporary Art, Sunderland Museum & Winter Gardens, Arts Centre Washington, the Fire Station and delivers programmes of cultural engagement and events across the whole city. It works across the city to ensure the power of great art, culture and creativity is harnessed for the benefit of Sunderland, its residents and visitors. Sunderland Culture's mission is to improve life for everyone in Sunderland through culture.
This policy sets out the basis on which any personal data NGCA collects from you, or that you provide to NGCA, will be processed by us and Sunderland Culture. The University is the data controller of any personal data we hold on you for our purposes, and when we share this data with Sunderland Culture, they will be a joint data controller.
Please read the following carefully to understand our views and practices regarding your personal data and how we will treat it.
In order to offer our events, offers, promotions and services to the residents, businesses and visitors of Sunderland (the Customers), and to manage this website, we will on occasion process personal data about our customers, stakeholders, partners, website visitors, members of the Sunderland community and any other individuals who show interest or are involved in our projects, events, services, offers or campaigns. When we process this data, we are the data controller and are responsible for what we do with that data and how it is processed.
Please use the sections below to read about how we process your personal data.
Information we may collect from you
How is your personal data collected?
Purposes for which we will use your personal data
Disclosure of your personal data
Third Party Links
2. Information we may collect from you
Personal data, or personal information, means any information about an individual from which that person can be identified.
In some circumstances we may anonymise your personal data so that it can no longer be associated with you for research or statistical purposes.
We may collect, use, store and transfer different kinds of personal data about you, depending on the ways in which you engage with us, which are listed in Purposes for which we use your personal data.
• Identity Data includes first name, last name, username or similar identifier, marital status, title, date of birth and gender.
• Contact Data includes billing address, delivery address, email address and telephone numbers.
• Financial Data includes bank account and payment card details.
• Transaction Data includes details about payments to and from you and other details of products and services you have purchased from us.
• Technical Data includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access this website.
• Profile Data includes [your username and password, purchases or orders made by you, your interests, preferences, feedback and survey responses.
• Usage Data includes information about how you use our website, products and services.
• Marketing and Communications Data includes your preferences in receiving marketing from us and our third parties and your communication preferences.
We may also collect, use and share Aggregated Data such as statistical or demographic data for any purpose. Aggregated Data may be derived from your personal data but is not considered personal data in law as this data does not directly or indirectly reveal your identity. For example, we may aggregate your Usage Data to calculate the percentage of users accessing a specific website feature.
We do not collect any Special Categories of Personal Data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sexual orientation, political opinions, trade union membership, information about your health and genetic and biometric data). Nor do we collect any information about criminal convictions and offences.
Any special category personal data we may have about you will have been made manifestly public by you or provided by you with your consent. We do not process special category data for any other reason than holding on file information you may have given us in relation to a transaction, for example, if you require assistance when attending the Gallery.
If you don't give us your personal data
Where we need to collect personal data to provide the offer or service you are interested in, we may not be able to provide that offer or service if you don't provide that data when requested. For example, we can't send your tickets for events if you don't provide a valid email address. If we don't have sufficient information to process any request you make our website will prompt you to complete the missing information, or we will notify you at the time.
2. How is your personal data collected?
We use different methods to collect data from and about you.
You may give us your personal data by filling in forms or by corresponding with us by post, phone, email or otherwise. This includes personal data you provide when you, for example:
• visit the Gallery;
• sign up for offers or services;
• subscribe to our newsletters or publications;
• request information or marketing from NGCA or one of our promotions;
• enter a competition, promotion or survey;
• attend an exhibition in person and sign up to a mailing list or promotion; or
give us some feedback.
As you interact with our website, we may automatically collect technical data about your equipment, browsing actions and patterns. We collect this personal data by using cookie. Please see our section on Cookies for further details.
We may also receive technical data from analytics providers such as Google, or other search engines and social media platforms when they are reporting on the interaction of our advertising or publicity campaigns and engagement.
If you are a business partner, or an employee or representative of one of our partner businesses, we may receive personal data about you from various third parties and public sources, including Sunderland City Council, Companies House, and LinkedIn.
3. Purposes for which we will use your personal data
We have set out below a description of the ways in which we may use your personal data, and what our legal basis under the General Data Protection regulation (GDPR) for that processing is. We have also identified what our legitimate interests are where appropriate.
A Legitimate Interest is an interest of our business in conducting and managing our business to enable us to give you the best service/product and the best and most secure experience. We make sure we consider and balance any potential impact on you and your rights before we process your personal data for our legitimate interests.
basis for processing
We send newsletters and emails to our audience.
We have a legitimate interest to keep you as our
long-standing friends of NGCA informed of our news and events. If you receive
these communications, you can object at any time by unsubscribing to any
email we have sent or by contacting us at email@example.com
To send you
newsletters and keep you updated with other offers and goings at NGCA.
We will add you
to our database if you sign up for our newsletters or marketing
communications; if you ask to be added; or if we meet you at a business or
networking event and you give us your contact details. We will then be
contacting you on the basis of your consent.
We may also
send you updates, newsletters, listings or other information regarding the
other Sunderland Culture venues and campaigns.
We will only
contact you for these purposes if you give us your consent, or in line with
your marketing preferences.
To send you
service message updates regarding Gallery or exhibition details or another
booking you may have made, such as a reservation or room hire.
This is on the
performance of our contract with you as the event or venue host.
To enter you
into competitions we may be running via any of our marketing channels.
We will enter
you on the basis of your consent, if you sign up or register for this
competition. We will manage the competition on the performance of our
contract with you to enter you into that competition.
payments and transactions of any purchases you make or our products and
We need to do
this in performance of our contract with you.
Asking you to
leave a review or take a survey in relation to any of our campaigns.
We do this for
the legitimate interest of improving the service we provide to businesses and
and protect our business and this website (including troubleshooting, data
analysis, testing, system maintenance, support, reporting and hosting of
data); to deliver relevant website
content and understand the effectiveness of our publicity and advertising
We may need to
use some technical data with is capable of identifying you. We do this on the
legitimate interest of developing NGCA and Sunderland Culture, our processes
and strategy to create campaigns and events that are of maximum benefit to
We have a legitimate business interest to use photos of our events in marketing documents, communications, in annual reports and on our website or publicity documents. If you attend an event where we may be taking photos, you will see signs notifying you of this. If you are identifiable from any image that we wish to use, we will take every reasonable step to ask for your consent to use this image. If we do not have your consent, we will not use an image which we believe identifies you in any campaign posters, publications, or other publically available documents. We may however use images from events on our social media. If we do use an image which you believe identifies you, and you would like us to take it down please contact firstname.lastname@example.org. We keep images on file for 7 years.
NGCA uses CCTV for crime prevention purposes. We have a legitimate interest to protect our visitors, staff and property through the use of CCTV. CCTV is only accessible to authorised users under strict access controls, and recordings are deleted after 28 days. If you would like to read our full CCTV policy, it is available from University of Sunderland.
If we contact you with newsletters or other news and updates regarding events, offers or promotions, we will either ask you for your consent, or alternatively we will send you materials we believe may be of interest to you as a legitimate business development interest. Whenever we send you marketing information, whether via email, post or text, we will provide you with an opportunity to object to this use of your personal data.
We will not send you email updates or any other marketing communications if you indicate that you do not wish to receive them. You can change your marketing preferences anytime, by contacting email@example.com.
When buying or ordering a product or service online, there may be an option to store your credit card data to make future purchases easier. This is encrypted through the Payment Card Industry Data Security Standard (PCI-DSS), and we do not have access to that information. Purchase transaction data is only used to complete your purchase transaction, after which it is deleted. PCI-DSS is managed by the PCI Security Standards Council to ensure secure card payments.]
4. Disclosure of your personal data
We share your personal information with Sunderland Culture, who manages the programme of NGCA, and the other Sunderland Culture venues. Sunderland Culture will manage your personal data securely to contact you only for the purposes of the products or services you have requested, or in line with your marketing preferences.
We may share your information with selected third parties including:
• business partners, suppliers and sub-contractors for the performance of any contract we enter into with them or you, which includes payment providers such as PayPal; and newsletter service providers such as MailChimp
• analytics and search engine providers that assist us in the improvement and optimisation of our Site; and
• credit reference agencies for the purpose of assessing your credit score where this is a condition of us entering into a contract with you.
We may disclose your personal information to third parties:
• in the event that we sell or buy any business or assets, in which case we may disclose your personal data to the prospective seller or buyer of such business or assets;
• if all, or substantially all, of our assets are acquired by a third party, in which case personal data held by us about our customers will be one of the transferred assets; and
• if we are under a duty to disclose or share your personal data in order to comply with any legal obligation; or to protect the rights, property, or safety of our customers, or others.
We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.
We do not transfer personal data outside the European Economic Area (EEA).
5. Data Retention
We only keep your personal data as already indicated above, for as long as is necessary for the purposes which it is provided. We will contact you from time to time to make sure you want to stay on our marketing database, which is cleansed regularly of old or inaccurate data. By law we have to keep basic information about our customers for six years after they cease being customers for tax purposes.
Where the information we have on you is not for marketing or purchase transactions purposes, all of the Sunderland Culture venues' personal data is retained in line with our stakeholder retention policy, which is available here: https://www.sunderland.ac.uk/help/corporate-legal/publication-scheme/policies-and-procedures/
As we continue to update and revise our data protection procedures and practices we may update this retention policy. Please check back from time to time or contact firstname.lastname@example.org to see how long your data may be held on file.
In some circumstances you can ask us to delete your data. See your Right to be forgotten below for further information.
In some circumstances we may anonymise your personal data so that it can no longer be associated with you, for historic, research or statistical purposes, in which case we may use this information indefinitely without further notice to you.
We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. However, the transmission of information via the internet is not completely secure. We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.
Cookies are small files saved to your computer's hard drive that track, save and store information about your interactions and usage of the website. This allows the website, through its server to provide the users with a tailored experience.
We work with third-party suppliers who may also set cookies on our Site, for example Twitter, Facebook and LinkedIn. These third-party suppliers are responsible for the cookies they set on our website. If you want further information please go to the website for the relevant third party.
How to turn off cookies
If you do not want to accept cookies, you can change your browser settings so that cookies are not accepted. If you do this, please be aware that you may lose some of the functionality of this website. For further information about cookies and how to disable them please go to: www.aboutcookies.org or www.allaboutcookies.org
8. Third Party Links
Our website may, from time to time, contain links to and from the websites of our partner networks, advertisers and affiliates. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for these policies. Please check these policies before you submit any personal data to these websites.
9. Your rights
You have the right to:
Request access to your personal data, known as a "data subject access request".
Request correction of any inaccurate personal data that we hold about you.
Request erasure of your personal data where there is no good reason for us continuing to process it. We may not always be able to comply with your request of erasure for legal reasons.
Object to processing of your personal data where we are relying on a legitimate interest. In some cases, we may demonstrate that we have compelling grounds to continue processing your information which override your request.
You also have the right to object where we are processing your personal data for direct marketing purposes.
Request restriction of processing of your personal data while we establish the data's accuracy; if our use is unlawful; to hold it on file in order to establish, exercise or defend legal claims; while we process your request to object to processing based on a legitimate interest.
Request the transfer of your automated personal data in a structured machine-readable format where we used the information to perform a contract with you, or you gave us your consent to process it.
Withdraw consent at any time where we are relying on consent to process your personal data.
Complain you have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk).