What we collect and how long we keep it
The ICA collects personal data in relation to the following areas:
When you sign up for an ICA Membership, we collect your personal data to process membership subscriptions and keep in touch with you about your membership. This information is stored and processed on our membership and third party ticketing software systems (Patronbase, Mailchimp and Rapidata) and digital ICA files, accessible only to our Membership Team. We keep this information for the duration of your membership and six years after your membership has lapsed to deal with any contract queries or legal claims. Following that, we anonymise your personal data retaining only details of your purchase history.
We will also ask for your consent to send you emails regarding Membership news and offers. You can unsubscribe from these emails at any time using the unsubscribe link at the bottom of each email.
When you make an online purchase, we collect your personal data in order to process your purchase, deliver the purchased item to you and provide any required after-sales services.
Your online purchases for tickets and membership are processed through a third party payment processor, Worldpay, and the personal data you submit is stored on our membership and ticketing software Patronbase. This information is only accessible to our Box Office and Membership Teams. We keep this information to allow for quicker future bookings and to notify bookers about vital information or changes to the programme. Personal data is retained for a maximum of six years since your last booking or purchase.
Your online purchases from the ICA Bookstore are processed through our third party e-commerce platform, Shopify. If you are making an online purchase via Shopify, you can also sign up as a guest instead of setting up an account – this means that your personal data will not be retained by Shopify and the ICA after your purchase has been made and delivered.
You can also make in-person purchases from the ICA for tickets, membership, books and other merchandise.
Online ICA Editions purchases are currently processed through Worldpay, but we are in the process of migrating our purchase system to Shopify. Shopify is currently used for our ICA Editions purchases at art fairs.
You can find details on our Ticketing Terms and Conditions here.
Our in-person ticket and membership purchases are processed through Patronbase. We only take personal data from customers buying tickets if the performance or event is not made on the day of the booking. This allows us to update you about any changes to timings or venue.
Personal data is retained for a maximum of six years since your last booking or purchase, to deal with contract queries or legal claims and is only accessible by our Box Office and Membership Team.
When you make an in-person purchase from the Bookstore, your personal data is not stored unless you order an item which is not in stock. In this case, we will request your contact information, which is then stored in a secure location that is only accessible to Bookstore Team. Your personal data is deleted once the item has arrived, is purchased and dispatched to you.
With regards to in-person ICA Editions sales, we collect your personal data through a purchase form for the purpose of payment, raise an invoice and ship the ICA Edition to you. All of your personal and financial data is only accessed by the staff responsible for ICA Editions and by our Finance Team. This form is only stored until Edition has been paid for and shipped. We also need to store your personal details for provenance purposes, as is routine with artwork purchases. In some cases, the artist of the edition might request your personal data for their provenance records. When this happens, we will get in touch with you to request your consent before we share your personal data with the artist.
The ICA does not store any credit or debit card details.
Newsletters and Invitations
You can sign up to receive our newsletters through our general newsletter sign-up or at the point of an online purchase. All electronic marketing communication from us will have an unsubscribe option so you can let us know immediately if you do not want to hear from us.
The general newsletter sign-up is via a Wufoo form integrated with Mailchimp, so your data automatically uploads to our mailing lists. For newsletters and invitations, your personal data is only accessible by the Communications Team.
If you sign up to our newsletters at the time of online or in-person purchases, your personal data is collected via Patronbase before it is uploaded to Mailchimp.
All our newsletters and invitations, with the exception of our Membership newsletters, are sent out by our Communications Team.
Members of the press, who we have been in touch with previously, may receive information from the ICA on forthcoming programme and invitations to events as sent out by the Communications Team. You can unsubscribe from these emails at any time using the unsubscribe link at the bottom of each email. You can sign up to receive emails from us via our general newsletter sign-up or by emailing email@example.com
We regularly survey our ticket bookers and visitors. The responses (feedback received) to these surveys help us evolve our communications and services and develop our programme. These surveys are also part of our Arts Council England funding requirements. All survey responses are anonymised, and any email data submitted to an associated survey ‘thank you for time’ prize draw is held separately.
Additionally, surveys related to equal opportunities are accessed and processed by the ICA’s HR Team – see below.
Private Events and Venue Hire
If you hire one of the ICA’s private hires spaces, we collect your personal data in order to process and deliver your booking. After your event, to comply with tax and accounting requirements we store all financial records for up to seven years and other contract paperwork for up to six years to deal with contract queries or legal claims.
If you write to us to enquire about our hires spaces, we will request for your consent to add you to our database to send you information related to our hires offers and new developments. You can unsubscribe from these emails at any time using the unsubscribe link at the bottom of each email.
Donations and ICA Friends
When you make a donation to the ICA or sign-up as an ICA Friend, we collect your personal data to process your donation, deliver Friends services to you, email you about the Friends Programme and related events and for gift aid purposes. If at any point you no longer wish to receive emails from us, you can use the unsubscribe link at the bottom of each email.
Your personal data will be requested via a Friends form. In order to process a donation, you may wish to provide your credit or debit card details via the Friends form. Once your donation is processed, your financial data is no longer stored but your contact details will be stored on Patronbase. The Development, Finance and Senior Management Teams have access to this data, which is stored for as long as your patronage lasts and deleted six years after your patronage has lapsed to deal with contract queries or legal claims.
If we deal with a Trust or a Foundation, the personal data that we hold will be the contact details from the relationship manager or primary contact of the organisation. This data is only accessed by the Development Team.
Other Contributions to the ICA
When you agree to be part of a committee, join our Board, present an exhibition, talk or event for the ICA or work with us on a project, we will need to collect, store and use your personal data in order for us to work together. This data is held securely and only accessed by the staff member or department who is working with you. All contract paperwork and personal data that you provide us with is stored for the duration of our contract/work together and for six years afterwards to deal with contract queries or legal claims.
We will ask for your consent to send you marketing materials by email. You can unsubscribe from these emails at any time using the unsubscribe link at the bottom of each email.
If you ask us to forward marketing materials to your contacts on your behalf, we will require you to confirm that you have the consent of your contacts to receive these materials.
Recruitment for ICA vacancies is by application form only to the firstname.lastname@example.org email account. All our current vacancies are advertised here.
Your application will be stored for the duration of the recruitment process (typically six to eight weeks after the deadline). If you have been invited for an interview, your application will be stored for six months after your interview date so we can respond to any queries you may have about your application and interview. If you are offered and accept a role at the ICA, your application form will be stored for the duration of your employment at the ICA.
All applications to the email@example.com account will be accessed by the HR Team. For shortlisting and interview purposes, your application will be reviewed by the HR Team and the Manager recruiting the role.
As part of your application, we also request you to fill in an anonymous Equal Opportunities form via Survey Monkey. This form is voluntary and anonymous, and is used to help monitor our recruitment and diversity reach. Surveys are stored for a period of twelve months before being deleted.
Personal data of suppliers, contractors and their employees
We may need to collect personal data from suppliers, freelance contractors or their employees to allow for the delivery of a service to the ICA. This data will only be accessed by the department or the staff member working with you. Contract paperwork will be stored for the duration of the contract and for six years after the contract has lapsed to deal with contract queries or legal claims. Personal data stored outside the framework of the contract or any related paperwork will be deleted after our work together comes to an end.
A 'cookie' is a tiny element of data that a website can send to a visitor’s computer’s browser (e.g. MS Internet Explorer or Google Chrome), so that their computer (or electronic device used to access the website) will be recognised by the ICA website on their return. Cookies also allow our web server to recognise a computer on connection to the ICA website, which in turn allows our server to make downloading of website pages faster than on first viewing. In addition, cookies may also be used by us to establish statistics about the use of the ICA website by Internet users by gathering and analysing data such as most visited pages, time spent by users on each page and website performance etc.
We collect and use such cookie data to enable us to develop and enhance the experience of visitors to the ICA website. Cookies do not identify you personally, but the computer or device used to access our website.
The data collected by our servers and/or through cookies that may be placed on your computer or device will not be kept for longer than is necessary to fulfil the purposes mentioned in this Policy. Unless stated in this Policy, cookies on the ICA website are usually only active for the duration of your visit and are not stored on your computer once you have closed your web browser.
Navigation data about site viewers is automatically collected by our servers. If you do not wish to have this navigation data collected, we recommend that you do not use the ICA website.
You can set your browser to block the recording of cookies on your computer or device to minimise the amount of data that may be collected about your visit. Your browser can also be set to notify you when a cookie is being recorded. However, if you block cookies then you may not be able to use all the features or services on our website.
In such circumstances, these cookies may be kept on the hard drive of your computer following closure of your web browser. Cookies used in connection with such personalised services enable us to build up a profile of our users and to develop personalised versions of the website.
We may also automatically collect information about each page you visit, including your domain, IP address, the previous site accessed and the browser you use and your operating system. This information is used for the purpose of monitoring and improving use of our website and is not used to identify you in any way.
Google will use this information for the purpose of evaluating your use of the website, compiling reports on website activity for website operators and providing other services relating to website activity and Internet usage.
Google may also transfer this information to third parties where required to do so by law, or where such third parties process the information on Google's behalf. Google will not associate your IP address with any other data held by Google. For more information, see 'How Google uses data when you use our partners' sites or apps'.
You may refuse the use of these cookies by selecting the appropriate settings on your browser.
The ICA uses this data to understand who our users are as an anonymised mass and how they are using our site. We do not have the ability to identify our website users by their IP address.
All the social media platforms we use provide anonymised data on the users of our pages or accounts for the purposes of analysis and reporting. We do not store identifying user data from any of the users of our social media platforms. We abide by the Terms and Conditions of each individual social media platform.
Filming, photography and CCTV
Sometimes filming, photography and audio recording is in use at the ICA, particularly during events and the recordings may be posted on our website or released by the ICA for promotional purposes. When this is the case, it is made clear by signage advising visitors to speak to ICA staff for further information if needed.
CCTV is in use at the ICA to protect our property and visitors. If you would like to see our CCTV policy, please email: firstname.lastname@example.org
The lawful grounds on which we collect and process personal data
The ICA processes your personal data for the above purposes relying on one or more of the following lawful grounds under Data Protection Law:
• Contract: where we provide services, in order to set up and perform our contractual obligations to individuals
• Consent: where you have freely provided your specific, informed and unambiguous consent for us to process your personal data for particular purposes
• Legitimate Interests: in connection with the ICA's legitimate interests of being able to effectively administer and promote the work of the ICA, run events, operate our Membership and Friends' programmes, run our shops and manage our services in a safe an efficient manner. We will always seek to pursue these legitimate interests in a way that does not unduly infringe on your other legal rights and, in particular, your right to privacy; and/or
• Legal Obligations: where we need to process personal data to comply with a legal obligation or for the purpose of us being able to establish, exercise or defend legal claims
We do not share, sell or rent your personal data to third parties for marketing purposes. However, we may need to share your personal data with third parties in the following circumstances:
• Where we are under a duty to disclose your personal information in order to comply with a legal obligation (for example to law enforcement agencies), or in order to enforce or apply our rights (including enforcing applicable terms and conditions) for where needed to protect ourselves against criminal or illegal activity – for example, to conduct fraud checks.
Data transfers outside Europe
For financial and technical reasons, the ICA may, on occasion use the data hosting or data processing services of a supplier who is based outside the UK and European Economic Area (EEA), which means that your personal information may be transferred to that supplier and processed and stored outside the UK and EEA.
This includes countries, such as the United States, that are not currently considered to have the same standards for legal protection of personal data that you enjoy in the UK.
However, we will always take steps to choose highly reputable suppliers, who respect your security and the ICA will put suitable legal safeguards in place with that supplier to protect your personal data, so that it is subject to the same standards of privacy that you have in the UK.
For further information about the above, please email: email@example.com