Privacy Notice: The Keeper of Paintings and the Mischievous Masterpieces

The National Gallery houses the national collection of paintings in the Western European tradition from the 13th to the early 20th centuries.

We are the data controller of your personal data at the point of and after submission of your/your child’s artwork, and we are registered with the Information Commissioner’s Office (ICO) under the registration number: Z5597415.

You can find us at the following address:

The National Gallery,
Trafalgar Square,
London, WC2N 5DN.

Arcade is the controller of the data submitted up to the point at which you/your child submits (or not) any artwork to the Gallery. Arcade acts as our data processor after submission of the artwork to us.

Arcade Ltd (t/a ARCADE XR) is a company incorporated in England and Wales with registered number 10299067, whose registered address is 32 Great Sutton Street, London, EC1V 0NB. Arcade’s privacy notice can be found at: https://www.arcade-xr.com/app-privacy-policy.

Personal data means any information about an individual that can identify the individual. For example, this could be their name; date of birth; contact details; photographs of the individual.

We might receive personal information that is provided to us directly by you or your child when: 

• You/your child submits a “painting” to the Gallery at the end of the App experience,
• If you/your child otherwise contact us by email, telephone or post.

We may collect and store the following personal information about you/your child in connection with the submission of their painting:  

• Your/your child’s likeness in the paintings (provided you/they are identifiable);
• Any of your/your child’s information in the fields where they are required to leave an artist nickname and a painting name;

We may also collect, store, and use the following personal information about you/your child should you/they contact us:

• Your/your child’s name;
• Your/your child’s contact details (email address, phone number and postal address); and
• any details provided in correspondence sent or received.

We will only collect and use personal information about you and your child if we have a legal basis for doing so under UK data protection law.

• Personal information included in the submitted artwork:

We ask you/your child, in the App’s terms and conditions and in messages within the App, not to leave any personal data when submitting their artwork. If, however, you/they do leave personal information, we will process it on the basis of your consent as a parent or legal guardian. We deem your consent is given by your agreeing to the App’s terms and conditions which refers to this privacy notice before the submission process. 

When your child uses one of the Gallery’s tablets in Art Road Trip and you are not present, we ask children to seek for an Art Road Trip facilitator’s review of their artwork before submitting it to us. Facilitators will ask your child to anonymise their information if needed.

For all remaining personal data that might be submitted to us without your consent by your child, we will rely on the Gallery’s legitimate interest as our basis for processing.

• Personal information when you/your child contact us:

Where you/your child contacts us to answer any questions you/they might have regarding the App or your/their data rights, we will use your/your child’s name and contact details to respond to your/their queries or exercise your/their data rights and we will process it on the basis of our legitimate interest.

• Personal information included in the submitted artwork:

The Gallery will delete or anonymise any personal data discovered in the submitted files (painting, artist nickname and painting name), i.e. all data that directly or indirectly identifies a user, including but not limited to a name and surname, a telephone number, an email or postal address, or a painting where the model is identifiable.

• Personal information when you/your child contact us:

We will only keep personal information about you and your child for as long as is necessary for the purposes set out in this notice, or to comply with legal requirements. 

We will not sell personal information to any third parties or external organisations.

We may share some personal information with Arcade who acts as our external data processor when an artwork is submitted. Arcade provides the image database where the files will be sent to and must have access to it to fix any problem that may arise.

You have certain rights concerning your personal information. We provide detailed information about your rights in the Gallery’s main General Privacy Notice, under the section titled ‘What rights do you have in relation to your personal information’.

You acknowledge that it may not always be practicable to remove such personal data from materials which have already been published or otherwise made available to the public. We will use our best endeavours to comply with your wishes in such circumstances.

• Personal information included in the submitted artwork:

When submitted to the Gallery, the artwork is transferred via https directly from the App to a secure back-end database which can only be accessed by us or Arcade personnel via unique password protected credentials. Arcade will provide hosting services for the backend database using a scalable and secure server configuration.

• Personal information when you/your child contact us:

We follow strict security rules when storing and disclosing your personal information. We provide detailed information on how we keep your information secure in the Gallery’s main General Privacy Notice, under the section 'How do we keep your information secure?'

All our staff and data processors who have access to and are associated with the processing of your personal information, are legally obliged to respect to confidentiality of your personal information.

The Gallery website uses a technology called ‘cookies’ to improve your experience and personalise the service you receive. We provide further information about this in our Cookies Policy. Such use may also be subject to Terms of Use.

If you have any queries or have any concerns about how we process your personal information, you can contact our Data Protection Officer via email at: dataprotection@nationalgallery.org.uk, or by writing to our the Data Protection Officer at: The National Gallery, Trafalgar Square, London, WC2N 5DN. 

You also have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), which oversees the protection of personal information in the UK (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance.