Who we are

This privacy notice tells you what to expect when Spike Island Artspace Limited (“Spike Island” or “we”) collects, uses and protects your personal information. When we do so we are regulated under the General Data Protection Regulation and we are responsible as ‘controller’ of that personal information for the purposes of those laws.

The personal information we collect, how we collect it and why we do so.

We only collect information that is necessary to run Spike Island, fulfil its obligations to you, and keep you informed about us and our activities.

Under data protection law, specific categories of personal information are regarded as sensitive. This is known as special category data and includes health information, information regarding race, religious beliefs and political opinions. We only collect such information in limited cases, and where there is a clear reason for doing so, such as in relation to accessibility to the Spike Island premises, recording accidents whilst you are there, or dietary requirements for event attendance.

For further details on when we collect personal information, what we collect as well as how we use it, please read the following sections:

Website users

When information is collected

When you visit our website, including when you purchase tickets or other products through the website shop.

What information we ask for

Name, billing address, delivery address, e-mail address, phone number (including mobile phone and contact preferences). We may also receive information about you indirectly from third parties, such as if you complete digital forms via our website or any third party websites, such as Eventbrite. Users can always refuse to supply personal identification information, but this may prevent them from engaging in certain website and visitor related activities.

How and why we use your information

We collect this personal information for our own legitimate interests. The reasons we collect this information include, but are not limited to:

• To process payments and fulfil orders for exhibition or events tickets, or to make a Gift Aid claim.
• To improve user experience or our website; we may use survey feedback from you to understand your interests and preferences.

Direct marketing

(including periodic e-newsletters, updates about events, information about promotions or surveys.)

What information we ask for

Name, address, e-mail address, phone number (including mobile phone and contact preferences).

How and why we use your information

We collect this personal information when we have your consent to send such marketing.

Gallery supporters

When information is collected

When you sign up to become a Spike Associate, make a donation to the gallery and/or ask us to claim Gift Aid, leave the gallery a gift in your will or fundraise to support us.

What information we ask for

Name, contact details and payment details.

How and why we use your information

We collect this personal information because it is in our legitimate interest to enable us to process the donation.

If we have entered into a contract with you, such as with Spike Associates. In particular:

• To process your donation
• To provide service information such as when your Spike Associate membership is coming to an end

We are also required by law to share your details with HMRC as part of the Gift Aid process and may process your personal information in other ways to comply with UK tax law.

Art lenders or donors

When information is collected

If you offer the gallery a gift, or sell, loan or transfer a piece of art work to us. In this process, information is collected during your correspondence with us regarding a piece of art work.

What information we ask for

Name and contact details.

How and why we use your information

We collect this personal information because it is in our legitimate interests, for the reasons set out below.

• in order to arrange viewings of, and meetings regarding, the relevant piece of art;
• In order to arrange transport of relevant pieces of art;

in order to fulfil any of our relevant tax and regulatory duties.

Tenants and licensees

When information is collected

We will collect information from you if you are a tenant, artist or licensee using a work space on the Spike Island premises.

What information we ask for

Name, address, email, and telephone contact details. We will also collect location data and security information obtained through electronic means including records related to Safescan swipe card access, computer use and CCTV.

How and why we use your information

We collect name, address, email and telephone contact information to be able to administer our contract with you.

It is in our legitimate interests to process CCTV and building access records to ensure the Spike Island premises are secure, as well as to prevent unauthorised access to restricted areas, and to ensure the premises are being used in line with lease agreements.

Gallery and café visitors

When information is collected

We may collect information about you when you visit the gallery premises, when you purchase a ticket, or approach us (whether on the phone or online) to seek information about the gallery.

Finally, we use CCTV to record images in our gallery and studios used by members of the public and tenants. We will only disclose CCTV images to third parties for the purposes of public safety and the prevention and detection of crime. CCTV images will not be released to the media for entertainment purposes or placed on the internet. You have the right to see CCTV images of yourself and be provided with a copy; please see ‘Your Rights’ below on how to make a request.

What information we ask for

Personal contact details such as email, phone number and address.

How and why we use your information

It is in our legitimate interests to process contact details to provide our gallery services to you. The reasons we collect this information include, but are not limited to:

• processing ticket purchase payments;
• delivering services and products to you;
• in order to contact you about schedules events or exhibitions; and
• to respond to your queries. It is in our legitimate interests to process CCTV footage to ensure our premises an people on it are safe.

Job applicant or volunteer

When information is collected

If you apply to work at Spike Island, as a volunteer or staff member, we will collect personal information from your application forms. We may also then collect information indirectly when we contact your referees or view social media as part of this process.

We may disclose personal information to a third party, for example where we want to take up a reference or obtain a check from the Disclosure and Barring Service, and where appropriate we will let you know first.

What information we ask for

Name, address and further contact details, and emergency contact details if you are successful with your application.

How and why we use your information

We collect this personal information because it is in our legitimate interests to allow us to process your application.

The reasons we collect this information include, but are not limited to:

• in order to process your application and to monitor recruitment statistics;
• for the purposes of administering our contract with you; and
• to contact you regarding the progress of your application.

We also collect this information to take steps to enter into a contract with you.

Staff and volunteers

When information is collected

If we offer you employment or a volunteer position, we will use the personal information you provided as part of the application process, as well as your photograph if you supply it to us. We may also collect CCTV footage and other information obtained through electronic means such as swipe/identity card records.

What information we ask for

Name*, bank details*, address* and contact details. CCTV footage and location data related to Safescan swipe card access records. You are required (under the terms of your contract of employment, or in order to enter into your contract of employment) to provide the categories of information marked * above to enable us to pay you, to provide you with your contractual benefits and to administer statutory payments such as statutory sick pay (SSP). If you do not provide this information, we may not be able to provide the services to you or administer your employment contract.

How and why we use your information

We collect this personal information because it is necessary for the performance of our contract with you.

The reasons we collect this information include, but are not limited to the following reasons:

• for pension services if applicable;
• to process BACS payments for your pay;
• to provide your benefits, support and allowances as part of your contract with us, if applicable;
• to maintain accurate employment records; and

we collect personal information to fulfil legal obligations we owe to HMRC, and the Disclosure and Barring Service. It is in our legitimate interests to process CCTV footage to ensure our premises and other people on them, are safe.

Who do we share your information with?

We will not sell your personal information to any third parties or external organisations.

We will share your information with our service providers or external data processors who carry out work on our behalf. Examples of such services providers/data processors include:

• Eventbrite, which provides marketing and event organisation services, including enabling purchasing of tickets for some of our events and exhibitions.
• Google Analytics, which provides a service allowing us to collect standard internet log information and details of visitor behaviour patterns. We do this to find out things such as the number of visitors to the various parts of the site. This information is only processed in a way which does not identify anyone. We do not make, and do not allow Google to make, any attempt to find out the identities of those visiting our site.
• We use Mailchimp, an email distribution service provider, to send out marketing emails and to manage our email communications.
• We use Capsule CRM to store and manage personal information.
• We use WooCommerce to manage our online shop and donations.
• We use Stripe to process payments through our online shop and donations.
• We use Sovereign Fire and Security to process Safescan swipe card access records relating to restricted areas of the gallery premises.

These companies are acting as our data processors and the contracts we enter into with them require them to comply with UK data protection laws, to process only for the purposes we specify, and ensure they have the appropriate controls in place to protect the security of your information.

We may also have to disclose your personal details if required by law. For example, we will share your personal information with HMRC for tax purposes if you Gift Aid your donation to us.

We will not use your personal information for third party marketing purposes without your prior express consent.

The data that we collect from you may be transferred to and stored at a destination outside of the European Economic Area (EEA). It may also be processed by our service providers operating outside of the EEA.

We take steps to ensure that in the event that your information is transferred outside of the EEA by our services providers, appropriate measurers and controls are in place to protect that information in accordance with applicable data protection laws and regulations. To obtain a copy of such safeguards please contact Jane Faram: jane.faram@spikeisland.org.uk.

Third party websites

Throughout our website we may link to other websites owned and operated by third parties. These other third party websites may also gather information about you in accordance with their own separate privacy notices. For privacy information relating to these other third party websites, please consult their privacy notices as appropriate.

Protection of your personal information

We have appropriate security measures to prevent personal information from being accidentally lost, or used or accessed unlawfully. This includes procedures to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so.

Our staff and data processors who access and are associated with the processing of, personal information, only do so in an authorised manner and are subject to a duty of confidentiality.

Retention of your personal information

We will process your personal information for as long as is necessary for the purposes set out in this privacy policy. Thereafter, we will keep your personal information for as long as is necessary to respond to any questions, complaints or claims made by you or on your behalf, to show that we have treated you fairly or to keep records required by law.  The data retention period will vary according to the nature of the purpose under which the information is held. For example, we retain Gift Aid declarations in accordance with specific HMRC guidance.

We will not retain your personal information for longer than necessary for the purposes set out in this policy and when we dispose of it we will destroy paper and electronic copies in a secure way.

Use of Cookies

Our website uses cookies to distinguish you from other users of our site. This helps us to provide you with a good experience when you browse our website and also allows us to improve our site. You can read more about how we use cookies on our website in our Cookie Policy.

Your rights and access to your information

We want you to remain in control of your personal data and understand your legal rights, which are to:

• require us to correct any mistakes in your information which we hold;
• require the erasure of personal information concerning you in certain situations;
• receive the personal information concerning you which you have provided to us, in a structured, commonly used and machine-readable format and have the right to transmit those data to a third party in certain situations;
• object at any time to processing of personal information concerning you for direct marketing;
• object to decisions being taken by automated means which produce legal effects concerning you or similarly significantly affect you;
• object in certain other situations to our continued processing of your personal information; and
• otherwise restrict our processing of your personal information in certain circumstances.

Please let us know of any changes to the personal information you give to us.

If you would like further information on your rights or wish to exercise them, please contact Spike Island’s Communications Manager by e-mail: jane.faram@spikeisland.org.uk.

You can unsubscribe from communications at any time by clicking on the link at the bottom of any e-mail newsletter we have sent to you or by contacting us at admin@spikeisland.org.uk.

Questions and complaints

Questions, comments and requests regarding this privacy notice are welcomed and should be addressed to jane.faram@spikeisland.org.uk.

If you are not happy with our response, or you believe that your data protection or privacy rights have been infringed, you can complain to the UK Information Commissioner’s Office (ICO) which regulates and enforces data protection law in the UK. Details of how to do this can be found at http://www.ico.org.uk.

Changes to our privacy notice

Any changes we make to our privacy notice in the future will be posted on this page and, where appropriate, notified to you by e-mail. Please check back frequently to see any updates or changes to our privacy notice.

Do you need extra help?

If you would like this notice in another format (for example audio or large print) please contact us (see ‘How to contact us’ above).