Skip to main content

Privacy Notice: The Keeper of Paintings and the Mischievous Masterpieces

We may be required to update the terms of this notice from time to time.

This privacy notice was last updated on 16 May 2024.

This privacy notice explains the use of your personal data and personal data about your child which the National Gallery might receive from you or your child in connection with our Keeper of Paintings and the Mischievous Masterpieces App (“the App”).  We refer to ourselves in this notice as the 'Gallery', 'we' or 'us'.

The App has been commissioned by the Gallery and developed by a digital agency called Arcade Ltd (“Arcade”) as part of Art Road Trip; a travelling art studio programme visiting 18 places across the UK from May 2024 to May 2025 as part of the Gallery’s bicentenary celebrations.

The App is aimed at children between the ages of seven and eleven who participate in Art Road Trip with their parents or guardians or with their school or other educators. It allows them to digitally create their own version of paintings held in the Gallery on a tablet provided by the Gallery or on their parents’/guardians’ device (tablet or smartphone). If they want to, users have the opportunity to submit their paintings to the Gallery, along with an Artist nickname and a Painting name they have invented. The Gallery may (at our sole discretion) use submissions in displays in the Gallery and across our social media channels (including our website).

Children will receive messages on the App and in the terms and conditions not to leave any personal data on the paintings and on the fields dedicated to filling in their artist nickname and painting name. They are expected to ask for their parents or guardians’ consent or ask an Art Road Trip facilitator to check the absence of personal data before submitting their artwork. However, if the children or their parents/guardians decide not to follow the instructions, some personal data might be received by the Gallery when submitting their artwork.

In this notice we describe how we may collect and store and how we will delete or anonymise your or your children’s personal data. We follow the UK General Data Protection Regulations (otherwise known as the 'UK GDPR') to make sure that we are using your/your children’s information the right way.

The National Gallery houses the national collection of paintings in the Western European tradition from the 13th to the early 20th centuries.

We are the data controller of your personal data at the point of and after submission of your/your child’s artwork, and we are registered with the Information Commissioner’s Office (ICO) under the registration number: Z5597415.

You can find us at the following address:

The National Gallery,
Trafalgar Square,
London, WC2N 5DN.

Arcade is the controller of the data submitted up to the point at which you/your child submits (or not) any artwork to the Gallery. Arcade acts as our data processor after submission of the artwork to us.

Arcade Ltd (t/a ARCADE XR) is a company incorporated in England and Wales with registered number 10299067, whose registered address is 32 Great Sutton Street, London, EC1V 0NB. Arcade’s privacy notice can be found at: https://www.arcade-xr.com/app-privacy-policy.

Personal data means any information about an individual that can identify the individual. For example, this could be their name; date of birth; contact details; photographs of the individual.

We might receive personal information that is provided to us directly by you or your child when: 

  • You/your child submits a “painting” to the Gallery at the end of the App experience,
  • If you/your child otherwise contact us by email, telephone or post.

We may collect and store the following personal information about you/your child in connection with the submission of their painting:  

  • Your/your child’s likeness in the paintings (provided you/they are identifiable);
  • Any of your/your child’s information in the fields where they are required to leave an artist nickname and a painting name;

We may also collect, store, and use the following personal information about you/your child should you/they contact us:

  • Your/your child’s name;
  • Your/your child’s contact details (email address, phone number and postal address); and
  • any details provided in correspondence sent or received.

We will only collect and use personal information about you and your child if we have a legal basis for doing so under UK data protection law.

  • Personal information included in the submitted artwork:

We ask you/your child, in the App’s terms and conditions and in messages within the App, not to leave any personal data when submitting their artwork. If, however, you/they do leave personal information, we will process it on the basis of your consent as a parent or legal guardian. We deem your consent is given by your agreeing to the App’s terms and conditions which refers to this privacy notice before the submission process. 

When your child uses one of the Gallery’s tablets in Art Road Trip and you are not present, we ask children to seek for an Art Road Trip facilitator’s review of their artwork before submitting it to us. Facilitators will ask your child to anonymise their information if needed.

For all remaining personal data that might be submitted to us without your consent by your child, we will rely on the Gallery’s legitimate interest as our basis for processing.

  • Personal information when you/your child contact us:

Where you/your child contacts us to answer any questions you/they might have regarding the App or your/their data rights, we will use your/your child’s name and contact details to respond to your/their queries or exercise your/their data rights and we will process it on the basis of our legitimate interest.

  • Personal information included in the submitted artwork:

The Gallery will delete or anonymise any personal data discovered in the submitted files (painting, artist nickname and painting name), i.e. all data that directly or indirectly identifies a user, including but not limited to a name and surname, a telephone number, an email or postal address, or a painting where the model is identifiable.

  • Personal information when you/your child contact us:

We will only keep personal information about you and your child for as long as is necessary for the purposes set out in this notice, or to comply with legal requirements. 

We will not sell personal information to any third parties or external organisations.

We may share some personal information with Arcade who acts as our external data processor when an artwork is submitted. Arcade provides the image database where the files will be sent to and must have access to it to fix any problem that may arise.

You have certain rights concerning your personal information. We provide detailed information about your rights in the Gallery’s main General Privacy Notice, under the section titled ‘What rights do you have in relation to your personal information’.

You acknowledge that it may not always be practicable to remove such personal data from materials which have already been published or otherwise made available to the public. We will use our best endeavours to comply with your wishes in such circumstances.

  • Personal information included in the submitted artwork:

When submitted to the Gallery, the artwork is transferred via https directly from the App to a secure back-end database which can only be accessed by us or Arcade personnel via unique password protected credentials. Arcade will provide hosting services for the backend database using a scalable and secure server configuration.

  • Personal information when you/your child contact us:

We follow strict security rules when storing and disclosing your personal information. We provide detailed information on how we keep your information secure in the Gallery’s main General Privacy Notice, under the section 'How do we keep your information secure?'

All our staff and data processors who have access to and are associated with the processing of your personal information, are legally obliged to respect to confidentiality of your personal information.

The Gallery website uses a technology called ‘cookies’ to improve your experience and personalise the service you receive. We provide further information about this in our Cookies Policy. Such use may also be subject to Terms of Use.

If you have any queries or have any concerns about how we process your personal information, you can contact our Data Protection Officer via email at: dataprotection@nationalgallery.org.uk, or by writing to our the Data Protection Officer at: The National Gallery, Trafalgar Square, London, WC2N 5DN. 

You also have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), which oversees the protection of personal information in the UK (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance.

Further reading

Child-friendly privacy notice

To find out what we do with your data and what are your rights, please read our child-friendly privacy notice.