Opening hours Gallery closed until 24 May 2024

Privacy policy

Privacy policy

Who we are

This privacy notice tells you what to expect when Spike Island Artspace Limited (“Spike Island”, “we”, “our” or “us”) collects, uses and processes your personal information. When we do so we are subject to UK data protection laws, which include the Data Protection Act 2018 (DPA 2018), UK General Data Protection Regulations (UK GDPR), and Privacy and Electronic Communication Regulations (PECR), and we are responsible as ‘controller’ of that personal information for the purposes of those laws.

The personal data we collect and why we do so

Personal information is any information relating to an identified or identifiable individual. We only collect personal information that is necessary to run Spike Island, fulfil its obligations to you, and keep you informed about us and our activities.

Under data protection law, specific categories of personal information are regarded as sensitive. This is known as special category data and includes information relating to health,  racial or ethnic origin and religious and philosophical beliefs. We only collect such information in limited cases, and where there is a clear reason for doing so, such as:

  • in relation to equal opportunities monitoring and reporting;
  • in relation to accessibility to the Spike Island premises;
  • recording accidents that may arise whilst you are on Spike Island premises; and
  • dealing with dietary requirements for event attendance.

We may also hold and analyse anonymised personal data in order to improve our understanding of our target audiences and of our supporters,  which is collected through the PwC Illuminate Audience Data Platform and the Culture Counts Impact and Insights toolkit. This is so we can offer you the most appropriate access to our exhibitions, public programme and report to key funders such as Arts Council England and Bristol City Council. This information is kept under review to ensure we are able to use the latest technologies to improve and personalise our services.

Unless specified otherwise, we typically collect personal data from you directly, for example if you submit an application with us, submit a query, visit our website or complete a survey.

For further details on when we collect personal information, what we collect as well as how we use it, please read the following sections:

When and how information is collected What information we collect How and why we use your information (including our lawful basis for processing)
Website visitors. When you visit our website, including when you make a donation, purchase tickets or other products through the website shop.

We may also receive information about you indirectly from third parties, such as if you complete digital forms via our website or any third party websites, such as Eventbrite. Users can always refuse to supply personal identification information, but this may prevent them from engaging in certain website and visitor related activities.

Name, billing address, delivery address, e-mail address, phone number (including mobile phone and contact preferences). We collect this personal information because it is necessary  for our own legitimate interests. Our legitimate interests include:

· making a Gift Aid claim; and

· improving user experience on our website – we may use survey feedback from you to understand your interests and preferences.

We also collect this information where it is necessary for performance of a contract with you, for example fulfilling orders for exhibition or events tickets.

Direct marketing. (including periodic e-newsletters, updates about events, information about how to support us, information about promotions). Name, address, e-mail address, phone number (including mobile phone and contact preferences). We collect this personal information when we have your consent to send such marketing.
Supporters and Members. When you sign up to become a Patron, or a  Spike Island Associate, make a donation to the organisation and/or ask us to claim Gift Aid, leave the gallery a gift in your will or fundraise to support us. Name; contact details; payment details; emergency contact details; access requirements

 

We collect this personal information because it is necessary for our legitimate interests to enable us to process the donation.

If we have entered into a contract with you, such as in your capacity as a Spike Island Associate or as a Patron, because it is necessary for the performance of that contract. In particular:

· to process your donation; and

· to provide service information, such as when your Spike Associate membership or Patron membership is coming to an end.

We are also required by law to share your details with HMRC as part of the Gift Aid process and may process your personal information in other ways to comply with UK tax law.

Art lenders or art donors. If you offer the gallery a gift, or sell, loan or transfer a piece of art work to us. In this process, information is collected during your correspondence with us regarding a piece of art work. Name and contact details. We collect this personal information because it is necessary for our legitimate interests, for the reasons set out below:

· in order to arrange viewings of, and meetings regarding, the relevant piece of art;

· in order to arrange transport of relevant pieces of art; and

· in order to fulfil any of our relevant tax and regulatory duties.

Tenants and licensees. We will collect information from you if you are a tenant, artist or licensee using a workspace on the Spike Island premises (including Spike Island Workspace users, virtual users and Hot Desk users).

 

Name; address’ email and telephone contact details.

We will also collect location data and security information obtained through electronic means including records related to Safescan swipe card access, computer use and CCTV.

We collect and process your name, address, and email and telephone contact information for the performance of our contract with you

It is in our legitimate interests to process CCTV and building access records to ensure the Spike Island premises are secure, as well as to prevent unauthorised access to restricted areas, and to ensure the premises are being used in line with lease agreements.

Gallery visitors, café customers and service enquirers. We may collect information about you when you visit the gallery premises, when you purchase a ticket or product, or approach us (whether in person, on the phone or online) to seek information about the gallery or our services.

 

We use CCTV to record images in and around our gallery and studios used by members of the public and tenants. We will only disclose CCTV images to third parties for the purposes of public safety and the prevention and detection of crime. CCTV images will not be released to the media for entertainment purposes or placed on the internet. You have the right to see CCTV images of yourself and be provided with a copy; please see ‘Your Rights’ below on how to make a request.

Personal contact details such as email, phone number and address.

 

We will also process CCTV images.

 

 

It is in our legitimate interests to process contact details to provide our gallery services to you. The reasons we collect this information include, but are not limited to:

· in order to contact you about scheduled events or exhibitions; and

· to respond to your queries.

We also collect this information where it is necessary for performance of a contract with you, for example fulfilling orders for exhibition or events tickets.

It is in our legitimate interests to process CCTV footage to ensure our premises and people on it are kept safe and to prevent and detect crime.

Job, volunteer or other opportunity applicants. If you apply to work or for an opportunity available at Spike Island, as a volunteer, staff member, commissioned artist or freelance worker, we will collect personal information from your application submission. We may also then collect information indirectly when we contact your referees as part of this process.

We may disclose personal information to a third party, for example where we want to take up a reference or obtain a check from the Disclosure and Barring Service, and where appropriate we will let you know first.

Name, address and further contact details; details of your qualifications, skills, experience and employment history; whether or not you have a disability for which the organisation needs to make reasonable adjustments during the recruitment process; information about your criminal record if you have any unspent convictions; information about your entitlement to work in the UK; and emergency contact details if you are successful with your application.

 

We collect this information to take steps to enter into a contract with you.

We also collect this personal information because it is in our legitimate interests to monitor and properly manage our recruitment process.

The reasons we collect this information include, but are not limited to:

· in order to process your application and to monitor recruitment statistics;

· for the purposes of administering our contract with you; and

· to contact you regarding the progress of your application.

 

 

Staff and volunteers. If we offer you an employment contract, a contracted commission or project, or a volunteer/trustee position, we will use the personal information you provided as part of the application or contract process, as well as your photograph and personal identification documentation (e.g. passport information) when this is required).

We may also collect CCTV footage and other information obtained through electronic means such as swipe/identity card records.

Name*, bank details*, address* and contact details. CCTV footage and location data  related to Safescan swipe card access records.

You are required (under the terms of your contract of employment, or in order to enter into your contract of employment) to provide the categories of information marked * above to enable us to pay you, to provide you with your contractual benefits and to administer statutory payments such as statutory sick pay (SSP). If you do not provide this information, we may not be able to provide the services to you or administer your employment contract.

 

We collect this personal information because it is necessary for the performance of our contract with you.

The reasons we collect this information include, but are not limited to the following reasons:

· for pension services if applicable;

· to process BACS payments for your pay;

· to provide your benefits, support and allowances as part of your contract with us, if applicable;

· to maintain accurate employment records; and

· we collect personal information to fulfil legal obligations we owe to HMRC, and the Disclosure and Barring Service. It is in our legitimate interests to process CCTV footage to ensure our premises and other people on them, are safe.

Clients. When you make an enquiry to Spike Island Exhibition Services (either in person, on the telephone or online), we will collect details so that we can communicate effectively with you about your enquiry. We will use the personal information you provide when an agreement for equipment hire or AV services is made. Name, billing address, delivery address, e-mail address, phone number (including mobile phone and contact preferences). We collect this personal information because it is necessary  for our own legitimate interests. Our legitimate interests include responding to your queries and maintaining accurate equipment records for audit and  insurance purposes.

We also collect this personal information because it is necessary for the performance of our contract with you, or necessary in order to enter into a contract with you, for example to process payments we receive from you and to provide you with the equipment or services outlined in our agreement with you.

Equal opportunities monitoring information

As part of our commitment to equality and diversity we monitor and analyse diversity information to ensure that our recruitment and selection processes are fair and inclusive to all. We collect this information about job applicants, opportunity applicants, staff members, board members, studio artists, associates members, artists, development contributors and freelance technicians, that choose to complete our Equal Opportunities Form.

If you choose to complete our Equal Opportunities Form, in addition to the information listed in the above table, we may collect the following information about you (which includes special category data): information about your sex, gender identity,  ethnic origin, sexual orientation, whether you identify as disabled or neurodivergent, age, socio-economic background and religion or belief.

The provision of this information is voluntary and will not be used in determining whether you are shortlisted for any role/s or opportunities you apply for.

Our lawful basis for collecting this information is ours and third parties’ legitimate interests, to monitor relevant diversity information and ensure that our workforce and community are fair and inclusive to all. Our special category processing condition is the equality of opportunity or treatment, substantial public interest condition.

Any information you choose to provide via our Equal Opportunities Form will be treated with the strictest confidence. We will use the equal opportunities monitoring data that we collect for anonymised statistical reporting.

Who do we share your information with?

We will not sell your personal information to any third parties or external organisations.

We will share your information with our service providers or external data processors who carry out work on our behalf. Examples of such services providers/data processors include:

  • Eventbrite, which provides marketing and event organisation services, including enabling purchasing of tickets for some of our events and exhibitions.
  • Google Analytics, which provides a service allowing us to collect standard internet log information and details of visitor behaviour patterns. We do this to find out things such as the number of visitors to the various parts of the site. This information is only processed in a way which does not identify anyone. We do not make, and do not allow Google to make, any attempt to find out the identities of those visiting our site.
  • We use Mailchimp, an email distribution service provider, to send out marketing emails and to manage our email communications.
  • We use Donorfy CRM to collect, store and manage personal information, and to process donations and membership payments.
  • We use WooCommerce to manage our online shop and donations.
  • We use Stripe and GoCardless to process payments through our online shop, donations and membership payments.
  • We use Gardis and Safescan to process swipe card access and check-in records relating to restricted areas of the premises.
  • We use Quickbooks as our accounting software.
  • We use Current RMS as our rental management software; and
  • We use Microsoft Office 365 as our email provider.

These companies are acting as our data processors and the contracts we enter into with them require them to comply with UK data protection laws, only process personal information for the purposes we specify, and ensure they have the appropriate controls in place to protect the security of your information.

Some of these service providers or external data processors may be based outside of the UK. For more information, including on how we safeguard your personal information when this occurs, see below: ‘Transferring your personal information out of the UK’.

We may also have to disclose your personal details if required by law or our regulatory obligations. For example, we will share your personal information with HMRC for tax purposes if you Gift Aid your donation to us.

We will not use your personal information for third party marketing purposes without your prior express consent.

Transferring your personal information out of the UK

To provide services to you, it is sometimes necessary for us to share or store your personal data outside of the UK. For example, with our service providers that are located outside the UK or transfer personal data outside of the UK.

Transfers of personal data outside of the UK are subject to special rules under UK data protection law. This is because non-UK countries do not have the same data protection laws as the UK.

We will ensure that any transfer of personal data outside of the UK, complies with data protection laws and that all personal data will be secure.

As a result, when we transfer personal data outside of the UK we will ensure that the transfer complies with data protection laws by following one of the below steps:

  • confirming that the recipient is located in a country which has been recognised as having an adequate level of protection for personal data (including recipients that have certified with UK Extension to the EU-US Data Privacy Framework);
  • putting in place safeguards (such as approved standard contractual clauses) so that you have enforceable rights and effective legal remedies; or
  • confirming that a specific exception applies under data protection law.

For more information about our international transfers, please contact Isabel Jones: isabel.jones@spikeisland.org.uk.

Third party websites

Throughout our website we may link to other websites owned and operated by third parties. These other third party websites may also gather information about you in accordance with their own separate privacy notices. For privacy information relating to these other third party websites, please consult their privacy notices as appropriate.

Protection of your personal information

We have appropriate security measures to prevent personal information from being accidentally lost, or used or accessed unlawfully. This includes procedures to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so.

We limit access to your personal information to our staff and data processors who have a genuine business need to access it. Those processing your personal information will only do so in an authorised manner and are subject to a duty of confidentiality.

Retention of your personal information

We will process your personal information for as long as is necessary for the purposes set out in this privacy policy. Thereafter, we will keep your personal information for as long as is necessary:

  • to respond to any questions, complaints or claims made by you or on your behalf;
  • to show that we have treated you fairly; and
  • to keep records required by law.

The data retention period will vary according to the type of personal data.. For example, we retain Gift Aid declarations in accordance with specific HMRC guidance.

We will not retain your personal information for longer than necessary for the purposes set out in this policy and when we dispose of your personal data, we will destroy paper and electronic copies in a secure way.

Use of Cookies

Our website uses cookies to distinguish you from other users of our site. This helps us to provide you with a good experience when you browse our website and also allows us to improve our site. You can read more about how we use cookies on our website in our Cookie Policy.

Your rights and access to your information

We want you to remain in control of your personal data and understand your legal rights, which are to:

  • require us to provide you with a copy of your personal information;
  • require us to correct any mistakes in your information which we hold;
  • require the erasure of personal information concerning you in certain situations;
  • receive the personal information concerning you which you have provided to us, in a structured, commonly used and machine-readable format and have the right to transmit those data to a third party in certain situations;
  • object at any time to processing of personal information concerning you for direct marketing;
  • object to decisions being taken by automated means which produce legal effects concerning you or similarly significantly affect you;
  • object in certain other situations to our continued processing of your personal information; and
  • otherwise restrict our processing of your personal information in certain circumstances.

Please let us know of any changes to the personal information you give to us.

If you would like further information on your rights, please contact Spike Island by e-mail: isabel.jones@spikeisland.org.uk or see the Guidance from the UK Information Commissioner’s Office (ICO) on individuals’ rights.

If you would like to exercise any of those rights, please:

  • email, call or write to us; and
  • let us have enough information to identify you; and
  • let us have proof of your identity and address (a copy of your driving license or passport and a recent utility or credit card bill) if requested; and
  • let us know what right you want to exercise and the information to which your request relates.

You can unsubscribe from communications at any time by clicking on the link at the bottom of any e-mail newsletter we have sent to you or by contacting us at admin@spikeisland.org.uk.

Questions and complaints

Questions, comments and requests regarding this privacy notice are welcomed and should be addressed to isabel.jones@spikeisland.org.uk.

If you are not happy with our response, or you believe that your data protection or privacy rights have been infringed, you can complain to the UK Information Commissioner’s Office (ICO) which regulates and enforces data protection law in the UK. Details of how to do this can be found at http://www.ico.org.uk.

Changes to our privacy notice

 Any changes we make to our privacy notice in the future will be posted on this page. Please check back frequently to see any updates or changes to our privacy notice. We may also take reasonable steps to notify you if such changes affect how your personal data is processed.

Date of last update: November 2023

Do you need extra help?

If you would like this notice in another format (for example audio or large print) please contact us at isabel.jones@spikeisland.org.uk.